Job ID: U#1329 - Global Cybersecurity Risk Analyst
PLEASE NOTE: This is a 6 month renewable contract and needs to meet Client full-time conversion policies. Those dependent on a work permit sponsor now or anytime in the future (ie H1B, OPT, CPT, etc) do not meet Client requirements for this opening.
Responsibilities:
· Support focused cybersecurity and information risk assessments for new and existing technologies, services, business initiatives, and third-party providers.
· Identify and document risk scenarios, including relevant assets, threats, vulnerabilities, controls, likelihood, and potential business impact.
· Communicate risk assessment findings clearly and effectively to risk owners, business stakeholders, information governance teams, and cybersecurity teams.
· Provide risk-based guidance that enables stakeholders to make informed decisions regarding risk acceptance, mitigation, transfer, or avoidance.
· Identify and recommend appropriate controls and risk treatment activities to effectively manage cybersecurity and information risks.
· Identify opportunities to improve the organization’s risk posture and assist in developing remediation and mitigation strategies.
· Assess residual risk following the implementation of mitigating or compensating controls.
· Track identified risks, issues, remediation activities, and risk events through closure.
· Support the execution of the third-party/vendor risk management lifecycle, including risk assessments, due diligence, control validation, ongoing monitoring, and remediation tracking.
· Support responses to external customer cybersecurity and information security questionnaires.
· Apply applicable legal, regulatory, contractual, and industry requirements when evaluating cybersecurity and third-party risks.
· Support risk reporting and documentation to provide appropriate visibility into material risks, issues, and remediation activities.
Requirements: A successful Global Cybersecurity Risk Analyst will demonstrate the following experience and competencies.
Education, Training, and Previous Experience
· Bachelor’s or master’s degree in business, Computer Science, Cybersecurity, Information Security, or a related field.
· 2+ years of experience in cybersecurity, information security, technology risk, or a related risk management role.
· 2+ years of experience managing risk and compliance matters or supporting applications, coordinating managed service provider activities, projects, systems, or third-party relationships requiring risk identification, assessment, remediation, and monitoring.
· Demonstrated understanding of operational, cybersecurity, information security, and technology risks.
· Strong business acumen with the ability to assess cybersecurity risks and potential impacts in the context of operational, financial, regulatory, and business objectives.
· Experience evaluating complex third-party risks through vendor risk management, information security, regulatory compliance, or audit activities.
· Hands-on experience using ServiceNow to perform and manage Vendor Risk Assessments.
· Experience working with recognized cybersecurity, risk, and compliance frameworks and methodologies, such as ISO/IEC 27001, COBIT, NIST Cybersecurity Framework, NIST SP 800-series guidance, and FAIR.
· Experience supporting or conducting cybersecurity risk assessments and documenting risk decisions.
Desired Certifications
The following certifications are preferred but not required:
· Certified Information Systems Security Professional (CISSP)
· Certified Information Security Manager (CISM)
· Certified Information Systems Auditor (CISA)
Knowledge and Skills
· Ability to conduct cybersecurity and information risk assessments, develop clear risk statements, and assess risk likelihood/frequency and potential impact.
· Ability to distinguish between risks, issues/findings, and control deficiencies, and evaluate how identified issues affect the likelihood or impact of associated risk entries in the Risk Register.
· Strong understanding of the components of risk, including assets, threats, vulnerabilities, business impacts, and controls, and how these elements interact to support risk-based decisions.
· Ability to evaluate control design and implementation and determine the effect of controls on inherent and residual risk.
· Ability to communicate cybersecurity risk findings to business and risk owners in a clear, objective, and fact-based manner that supports informed decision-making and balances risk mitigation with business objectives.
· Ability to translate technical cybersecurity concerns into meaningful business risk and impact.
· Understanding of organizational mission, values, objectives, and business priorities, with the ability to apply this context to risk decisions.
· Ability to manage multiple priorities simultaneously while gathering and evaluating information across different functions and stakeholders.
· Strong analytical and critical-thinking skills, with the ability to challenge assumptions and reach defensible, evidence-based risk conclusions.
· Ability to develop practical and innovative approaches to managing cybersecurity and information risk.
· Strong customer and business orientation, with a commitment to providing timely, efficient, and high-quality support.
· Ability to effectively influence stakeholders and facilitate appropriate risk management decisions.
· Excellent prioritization and organizational skills, including the ability to break complex work into manageable components and prioritize activities based on risk and business need.
· Strong decision-making capabilities, including the ability to evaluate the costs, benefits, and risk implications of potential courses of action.
· Strong problem-solving, analytical, and troubleshooting skills.
· Strong written and verbal communication skills.
