Job Overview:
The Principal Cyber Risk Analyst is responsible for leading the organization's enterprise cyber risk management program by identifying, assessing, prioritizing, and reporting technology and cybersecurity risks across the enterprise. This role serves as a strategic advisor to technology, cybersecurity, and business leadership by providing risk insights that support decision-making, risk treatment strategies, regulatory compliance, and organizational resilience.
The position partners closely with cybersecurity, infrastructure, application, cloud, data, privacy, compliance, audit, and business stakeholders to establish a sustainable risk management framework, drive remediation efforts, measure risk reduction, and communicate risk posture to executive leadership and governance committees.
Job Responsibilities:
Core Responsibilities
- Lead the identification, assessment, analysis, and prioritization of technology and cybersecurity risks across infrastructure, applications, cloud environments, operational technology, data platforms, and third-party ecosystems
- Establish and maintain an enterprise-wide cyber risk register, ensuring risks are accurately documented, quantified, monitored, and reported
- Provide expert guidance on emerging technology risks, threat trends, and control weaknesses that may impact organizational objectives
- Translate complex technical risks into business-focused risk narratives, impacts, and mitigation strategies.
- Lead risk review meetings and challenge sessions with technology and business leaders to ensure risks are understood, accepted, mitigated, or escalated appropriately
- Partner with security, technology, and business teams to validate remediation plans and monitor progress toward risk reduction objectives
- Facilitate discussions to remove barriers to remediation and ensure risk treatment activities align with enterprise priorities
- Provide oversight of cybersecurity risk assessments associated with vendors, service providers, and strategic technology partners
- Lead initiatives to enhance the organization's cyber risk management framework, methodology, tools, and reporting capabilities
- Mentor junior analysts and provide thought leadership across the cyber risk management function
- Act as a trusted advisor to senior technology leaders, cybersecurity leadership, risk officers, and business executives
- Performs other duties as assigned
Job Requirements:
Education/ Certifications:
- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business Administration, or related field
- One or more preferred certifications:
- CISSP
- CRISC
- CISM
- CGEIT
- CISA
- FAIR Certification
Experience:
- 10+ years of progressive experience in cybersecurity, information security, technology risk management, governance, risk and compliance (GRC), audit, or related disciplines
- Experience leading enterprise cyber risk assessments and facilitating risk evaluations across infrastructure, cloud platforms, applications, data, operational technology, and third-party environments
- Demonstrated experience developing and managing cyber risk registers, issue management processes, risk treatment plans, and executive risk reporting
- Experience partnering with technology owners and business leaders to prioritize remediation activities based on risk exposure and business impact
- Experience supporting or leading regulatory, compliance, and audit initiatives including SOX, HIPAA, PCI-DSS, NIST, ISO 27001, and other relevant frameworks
- Experience presenting cybersecurity risks, trends, and remediation status to executive leadership, governance committees, and internal audit stakeholders
- Demonstrated success leading strategic cybersecurity initiatives and influencing cross-functional teams without direct authority
- Experience developing and maturing cybersecurity governance, risk assessment, risk quantification, and reporting methodologies
- Prior experience mentoring analysts and leading enterprise-scale risk programs preferred
Knowledge/Skills/Abilities:
- Expert understanding of cybersecurity and risk management frameworks including NIST CSF, NIST RMF, COBIT, ISO 27001, CIS Controls, FAIR, and regulatory requirements
- Strong knowledge of cybersecurity domains including identity management, network security, cloud security, application security, vulnerability management, data protection, disaster recovery, and third-party risk management
- Ability to assess technical control deficiencies and translate findings into business risk statements understandable by executive leadership
- Advanced understanding of risk governance, risk quantification, risk treatment planning, issue management, and control effectiveness measurement
- Experience designing and implementing cyber risk metrics, key risk indicators (KRIs), and executive reporting dashboards
- Strong facilitation and stakeholder management skills with demonstrated ability to drive consensus across technical and business teams
- Exceptional written and verbal communication skills with experience presenting risk information to senior leadership and executive committees
- Ability to influence Director, VP, and executive-level stakeholders through data-driven risk analysis and recommendations
- Strong business acumen with the ability to align cybersecurity investments and remediation activities to enterprise objectives
- Ability to lead large-scale risk and governance initiatives with minimal direction.
- Strong analytical, critical thinking, and prioritization skills
- Ability to establish risk-based decision frameworks that support remediation prioritization and resource allocation
- Good judgment is required for this position as there may be times when direct supervision may not be immediately available
Work Environment:
Remote Role:
- This position is classified as remote where the associate will perform remote work from their primary residence. Remote associates are welcome to work from the office but are not required to do so. While remote associates are not required to work from an office on a regular basis, they may be required to come to the office or other UNFI locations for necessary business reasons or if directed to do so by their manager.
Physical Environment/Demands:
Office Roles:
- Most work is performed in a temperature-controlled office environment.
- Incumbent may sit for long periods of time at a desk or computer terminal.
- While performing the duties of this job, the employee is regularly required to sit; use hands to finger, handle, or feel; reach with hands and arms; and talk or hear.
- Incumbent may use calculators, keyboards, telephones, and other office equipment in the course of a normal workday.
- Stooping, bending, twisting, and reaching may be required in the completion of job duties.
The above statements are intended to describe the general nature of the work performed by the employees assigned to this job. All employees must comply with Company policy and applicable laws. The responsibilities, duties and skills required of personnel so classified may vary within each department and/or location.
UNFI is an Equal Opportunity employer committed to creating an inclusive and respectful environment for all. All qualified applicants will receive equal consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity or expression, national origin, disability, protected veteran status, or other protected ground. Accommodation is available upon request for candidates taking part in all aspects of the job selection process. - Veteran/Disability. VEVRAA Federal Contractor.
Compensation: UNFI anticipates paying the above-referenced pay rate (or within the above-referenced pay range) for this position. Actual Pay, where applicable, will depend on a number of factors, including, but not limited to, education, experience, training, and any requirements under applicable collective bargaining agreements. UNFI is committed to transparency in pay in compliance with applicable state and local laws.
Benefits: For Washington positions (or positions that may be performed remotely from Washington), for Washington-specific paid time off details.
Candidates hired into this position will also be eligible to participate in the following benefits programs: Paid Time Off; Sick Time; paid holidays and parental leave; 401K Program; medical, dental, vision, life, and accidental death/dismemberment insurance; short-term and long-term disability insurance program, Flexible Spending Account and/or Health Savings Account, subject to meeting the eligibility requirements and the terms and conditions of these programs, and subject to any requirements under applicable collective bargaining agreements.
UNFI's compensation, benefits, and paid time off policies are subject to change in the Company's sole discretion, consistent with applicable law. This job posting should not be construed as an offer of employment with certain terms, nor should it be construed as a guaranteed minimum.
Qualified applications with arrest or conviction records will be considered for employment in accordance with the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act .
