We are seeking a Technology & Cybersecurity Risk Management Analyst to support technology risk, cybersecurity risk, and governance initiatives. The ideal candidate will have hands-on experience with COBIT, NIST, and ISO 27001/ISO 27002 frameworks, along with strong experience in risk assessments, controls, compliance, and remediation tracking.
Key Responsibilities
- Conduct technology and cybersecurity risk assessments across applications, infrastructure, cloud, and third-party environments.
- Identify, analyze, document, and monitor technology risks, control gaps, and vulnerabilities.
- Perform inherent and residual risk assessments and support risk treatment and mitigation activities.
- Evaluate technology controls against NIST, COBIT, ISO 27001/27002, and organizational policies.
- Support Governance, Risk & Compliance (GRC) processes and maintain risk and control documentation.
- Assist with control assessments, evidence collection, control testing, and remediation tracking.
- Develop and maintain risk registers, assessment reports, risk metrics, and management dashboards.
- Partner with cybersecurity, infrastructure, application, compliance, audit, and business teams to address identified risks.
- Support risk intake and triage, including reviewing new technology initiatives and determining potential security and compliance risks.
- Track remediation plans, action items, exceptions, and risk acceptances through closure.
- Support internal and external audit and compliance activities.
- Identify emerging technology and cybersecurity risks and communicate their potential business impact to stakeholders.
- Help improve technology risk management processes, methodologies, procedures, and reporting.
Required Qualifications
- 5+ years of experience in Technology Risk, Cybersecurity Risk, IT Risk, GRC, IT Audit, or Information Security.
- Strong hands-on knowledge of NIST Cybersecurity Framework / NIST SP 800-series.
- Strong understanding of COBIT governance and control frameworks.
- Experience with ISO 27001 / ISO 27002 information security standards.
- Experience performing IT/cybersecurity risk assessments and control assessments.
- Knowledge of risk identification, risk scoring, inherent/residual risk, risk treatment, and remediation.
- Experience documenting and evaluating IT general controls (ITGC) and cybersecurity controls.
- Strong understanding of cybersecurity governance, policies, standards, and compliance requirements.
- Excellent analytical, documentation, communication, and stakeholder-management skills.
- Strong proficiency with MS Excel, Word, and PowerPoint.
Preferred Qualifications
- Experience with GRC platforms such as ServiceNow GRC/IRM, Archer, RSA, MetricStream, or similar.
- Experience with third-party/vendor risk management.
- Knowledge of SOC 2, PCI DSS, SOX, or other regulatory/compliance frameworks.
- Experience working with cloud, infrastructure, application, and enterprise technology risks.
- Certifications such as CRISC, CISA, CISSP, CISM, or ISO 27001 are a plus.
Core Skills
Technology Risk | Cybersecurity Risk | IT Risk | GRC | Risk Assessment | Risk Register | Control Assessment | Control Testing | NIST | COBIT | ISO 27001 | ISO 27002 | ITGC | Risk Remediation | Risk Treatment | Third-Party Risk | Compliance | Audit | Cybersecurity Governance