Cyber Risk Management Analyst

Employment Type: 12-Month Contract (1099 / C2C)
Location: Nearshore / Offshore (LATAM preferred) – Remote
Hours: Must overlap with US Eastern Time (EST) for stakeholder working sessions and handoffs

Engagement Requirements:

• 1099 or C2C only; candidate must have their own company or be no more than one level down
• Must be able to accept payment in USD

Overview

The Cyber Risk Management Analyst plays a key role in identifying, assessing, and mitigating cybersecurity risks across systems and processes. This role executes repeatable software assessments and vulnerability management activities using a structured approach — capturing evidence, documenting findings, tracking remediation items, and preparing complete assessment packages and reporting outputs for manager review and final risk decisions. The analyst collaborates with cross-functional teams to ensure compliance with security standards and supports the development of risk management strategies.

Core Responsibilities

• Conduct risk assessments to identify potential threats and vulnerabilities across business applications and services
• Perform software assessments for applications, platforms, and technology services to identify control gaps, security concerns, and required follow-up actions
• Support vulnerability management processes by validating findings, tracking remediation progress, and documenting outputs for downstream review and leadership visibility
• Support the development and maintenance of cyber risk scenarios and scenario-based risk statements with required comments and evidence
• Coordinate working sessions with system owners, track follow-ups, and close documentation gaps
• Capture evidence, document findings, and record stakeholder comments in a consistent, repeatable format
• Monitor and report Cyber Key Risk Indicators (KRIs) under guidance from senior team members
• Provide inputs for leadership cadence and steering reporting; stay informed on emerging threats
• Document assessments initially in Excel and support migration to automation in a new GRC platform
• Upload supporting artifacts to the team repository for audit readiness
• Update manager weekly on progress, including closed assessments, open assessments, and roadblocks requiring escalation

Required Experience

• 3+ years executing software assessments and vulnerability management activities with strong documentation, evidence collection, and stakeholder follow-up discipline
• Demonstrated ability to develop and maintain scenario-based cyber risk statements and capture consistent scoring inputs with clear rationale
• Experience identifying security gaps in applications, platforms, or systems and documenting key risks, mitigation actions, and remediation progress for leadership review
• Strong Excel skills for assessment tracking and rollups, plus clear written status reporting for leadership cadence
• Proficiency with standard business tools: Outlook, Teams, Zoom, SharePoint, Excel, PowerPoint, and Power BI

Preferred Experience

• Familiarity with structured software assessment practices (questionnaires, evidence capture, assessment report packages)
• Experience with enterprise cyber risk assessment methods incorporating stakeholder input and structured scoring for likelihood, impact, and preparedness
• Experience supporting technical debt reduction, including analysis and remediation tracking for legacy/end-of-life systems
• Experience monitoring and reporting cyber program metrics for recurring leadership and steering cadences

Technology Stack

• GRC: Onspring
• ITSM / CMDB: ServiceNow
• Collaboration & Reporting: SharePoint, Excel, PowerPoint, Power BI
• Core: Outlook, Teams, Zoom

Education

Bachelor’s degree or equivalent experience. Preferred certifications: CRISC, CISA, CISSP, or similar risk/audit-focused credentials.