Senior Technology & Cyber Risk Manager / Risk Data Analyst

Senior Technology & Cyber Risk Manager / Risk Data Analyst

Position Overview

We are seeking a senior individual contributor to serve as a Senior Technology & Cyber Risk Manager / Risk Data Analyst. In this role, you will be responsible for identifying, evaluating, tracking, and reporting on risks across information technology, information security, and external third-party environments. Additionally, you will lead initiatives around risk data analytics, executive reporting, and process automation.

This position bridges technical expertise in IT and cyber risk management with advanced capabilities in data analysis, executive-level storytelling, and process optimization. You will leverage modern tools—such as Power BI, Power Automate, PowerPoint, and artificial intelligence—to evolve our risk practices and deliver strategic, actionable insights to leadership.

Operating at a manager level, you will function with high autonomy, exercise strong independent judgment, and exert cross-functional influence to help the organization meet its core risk objectives.

Key Responsibilities

1. Information Technology Risk Management

• Assessments: Lead and execute comprehensive IT risk reviews across core business applications, infrastructure, cloud environments, and data frameworks.

• Prioritization: Detect, analyze, and rank risks impacting infrastructure reliability, data integrity, business continuity, and system uptime.

• Register Management: Maintain the central technology risk register, ensuring accurate risk profiling, grading, and mitigation tracking.

• Control Evaluation: Review, analyze, and challenge the design and operating effectiveness of IT General Controls (ITGCs) and specialized application controls.

• Framework Alignment: Benchmark and map organizational risk controls against recognized industry standards (e.g., NIST, ISO 27001, COBIT, SOC 2, CIS Controls).

• Remediation Partnership: Collaborate closely with IT and Security departments to strengthen controls and resolve identified risk items.

• Metric Development: Formulate, monitor, and report on Key Risk Indicators (KRIs) aligned with organizational risk tolerance boundaries.

• Project Oversight: Provide independent oversight and challenge to ensure potential vulnerabilities are adequately addressed within new technical initiatives and organizational changes.

• Audit & Compliance Support: Act as a subject matter expert to support regulatory exams, internal/external audits, and compliance reviews by delivering required evidence and documentation.

• Trend Monitoring: Keep pace with emerging tech developments (e.g., cloud architectures, AI tools) and translate them into protective strategies.

2. Cybersecurity Risk Oversight

• Security Evaluations: Oversee cyber risk assessments across internal networks, cloud instances, and hybrid architectures.

• Security Alignment: Partner with information security leaders to identify and prioritize critical vulnerabilities across the digital estate.

• Domain Reviews: Examine security controls across fundamental areas including Identity & Access Management (IAM), data protection/encryption, network/endpoint defense, and incident response readiness.

• Standard Mapping: Ensure operational alignment with cybersecurity frameworks like NIST CSF, NIST 800-53, ISO 27001/27002, and CIS Controls.

• Vulnerability & Incidents: Monitor vulnerability remediation pipelines, penetration testing results, and contribute to cyber incident readiness efforts (e.g., tabletop simulations).

• Threat Mitigation: Address risks stemming from modern threat vectors such as ransomware, supply chain vulnerabilities, and cloud-native exploits.

• Executive Metrics: Construct cyber-focused KRIs and high-level summaries for leadership visibility.

• Independent Challenge: Provide critical, unbiased feedback on new security designs, policies, and strategic initiatives.

• Emerging Tech Safety: Actively contribute to establishing risk parameters around artificial intelligence and generative AI deployments.

3. Risk Data Analytics & Reporting

• Data Aggregation: Gather, clean, and validate risk intelligence from varied platforms, including GRC systems, security suites, and vendor portals.

• Dashboard Design: Build and maintain interactive Power BI dashboards focused on risk profiles, KRI trends, and vendor vulnerabilities.

• Executive Storytelling: Transform complex risk metrics into clear, high-impact PowerPoint decks and written narratives tailored for executive leadership.

• Pattern Detection: Utilize advanced data diagnostics to uncover underlying trends, systemic anomalies, and evolving risk patterns.

• Strategic Support: Enable data-driven organizational choices through clean visual models and actionable takeaways.

• Data Governance: Maintain high standards of accuracy, documentation, and repeatability across all standard reporting processes.

4. Process Automation & Innovation

• Workflow Optimization: Architect and launch Power Automate scripts to streamline routine risk evaluations, sign-offs, and data flows.

• Manual Reduction: Review current operational pipelines to identify bottlenecks and eliminate manual redundancies.

• AI Integration: Experiment with and implement AI and Generative AI functionalities to optimize text summarization, data categorization, and report production.

• Efficiency Drills: Drive continuous improvement cycles to lower processing turnaround times and elevate accuracy.

• Safe AI Governance: Help establish guardrails for the organization’s deployment of AI, keeping data privacy, algorithmic bias, and correctness in check.

Qualifications & Skills

Required Experience

• Professional Background: 5+ years of progressive experience in IT/Cyber Risk Management, Governance, Risk and Compliance (GRC), or specialized Risk Data Analytics.

• Assessment Execution: Proven track record of spearheading formal risk evaluations and overseeing corrective action plans from start to finish.

• Framework Literacy: Working knowledge of mainstream control standards (e.g., NIST, ISO, SOC).

Technical & Analytical Capabilities

• Data Visualization: High proficiency in Power BI, including robust data modeling and building intuitive dashboards.

• Data Manipulation: Advanced capabilities in Microsoft Excel for sorting, parsing, and analyzing large datasets.

• Presentation Design: Advanced PowerPoint skills with a knack for structuring sophisticated executive-level presentations.

• Insight Extraction: Demonstrated capability to translate raw metrics into strategic recommendations.

Automation & Modern Tech

• Workflow Automation: Practical experience deploying Power Automate or equivalent workflow engines.

• AI Exposure: Familiarity using AI or Generative AI tools to boost daily output and scale data analysis.

• Data Integration: Basic familiarity utilizing APIs to pull, share, and centralize dataset components.

Soft Skills

• Communication: Exceptional verbal and written communication skills.

• Storytelling: Strong ability to weave technical risk metrics into a business-oriented narrative for senior leaders.

• Translation: Capable of explaining deep technical and cyber concepts in a way that non-technical business partners can easily digest.

Education

• Degree: Bachelor’s degree in Information Technology, Cybersecurity, Computer Science, Risk Management, Business, Finance, or a closely related discipline.

Preferred Qualifications ("Nice to Have")

• Industry Credentials: Relevant professional certifications such as CISA, CRISC, CISM, CISSP, CTPRP, or PMP.

• Advanced Degree: Master’s degree (MBA, MS in Cybersecurity, or similar technical field).

• GRC Infrastructure: Hands-on experience working with modern GRC enterprise platforms (e.g., ServiceNow GRC, Archer, OneTrust).

• Cloud Knowledge: Foundational understanding of secure architectures across AWS, Microsoft Azure, or GCP.

• Coding/Query Skills: Experience utilizing data or scripting tools such as SQL, Python, or PowerShell.

• Leadership Exposure: Prior experience directly presenting risk metrics to senior leadership circles or risk governance committees.