Key Responsibilities
· Evaluate, assess, and monitor cybersecurity and third-party risk activities in alignment with organizational risk management objectives.
· Partner with business stakeholders to gather, analyze, and document business requirements for risk management processes and technology solutions.
· Develop business use cases, user stories, process maps, and functional requirements to support cybersecurity and GRC initiatives.
· Manage and prioritize enhancement requests, ensuring business needs are clearly documented and translated into actionable development requirements.
· Coordinate and execute system testing activities, including test strategy development, test script creation, user acceptance testing (UAT), defect tracking, and validation of implemented solutions.
· Collaborate with technical teams to support solution design, implementation, and deployment activities.
· Analyze existing workflows and identify opportunities to improve operational efficiency, data quality, automation, and user experience.
· Act as a liaison between cybersecurity teams, business stakeholders, and technology partners to ensure successful delivery of enhancements and process improvements.
· Support data governance and stewardship activities to ensure the integrity, accuracy, and consistency of information used in risk management processes.
· Develop metrics, reporting, and dashboards to provide visibility into risk posture, operational performance, and program effectiveness.
· Participate in risk assessments, control evaluations, and remediation tracking activities.
· Prepare business and technical documentation, including requirements, testing artifacts, training materials, and process documentation.
· Support audit, compliance, and regulatory activities by providing documentation and evidence related to cybersecurity risk management processes and system controls.
Preferred Qualifications
· Demonstrated experience as a ServiceNow Analyst, Business Analyst, or Product Owner supporting enterprise workflows and business process improvements.
· Strong understanding of cybersecurity risk management, third-party risk management, and GRC processes.
· Experience developing business requirements, use cases, user stories, workflow diagrams, and testing documentation.
· Proven experience managing enhancement requests and driving projects through the full solution lifecycle, from requirements gathering through testing and implementation.
· Experience leading or coordinating User Acceptance Testing (UAT) and defect management processes.
· Strong analytical, problem-solving, communication, and stakeholder management skills.
· Ability to translate complex business requirements into functional solutions that align with organizational objectives.
· Experience working in cross-functional environments involving business, cybersecurity, risk, compliance, and technology teams.
Minimum Education/Experience
· Bachelor’s degree in Information Security, Computer Science, or related field; or equivalent experience.
· 10 plus years of experience in cybersecurity risk analysis or related field.
· Strong analytical skills, ability to work independently, and collaborative interpersonal skills.
· Experience in business analysis, including requirements gathering and test case development.
Preferred Experience
· Experience with ServiceNow or similar vendor management software.
· Understanding of procurement and risk processes.
· Knowledge of information security and risk control frameworks.
· Familiarity with ISO 27001, SOC 2, HITRUST, FedRAMP, and ISO 22301 standards.
· Operational experience with GRC toolsets.
· CISSP/CISM certification (or similar).
