Global Cybersecurity Risk Analyst

Job ID: U#1329 - Global Cybersecurity Risk Analyst

PLEASE NOTE: This is a 6 month renewable contract and needs to meet Client full-time conversion policies. Those dependent on a work permit sponsor now or anytime in the future (ie H1B, OPT, CPT, etc) do not meet Client requirements for this opening.

Responsibilities:

· Support focused cybersecurity and information risk assessments for new and existing technologies, services, business initiatives, and third-party providers.

· Identify and document risk scenarios, including relevant assets, threats, vulnerabilities, controls, likelihood, and potential business impact.

· Communicate risk assessment findings clearly and effectively to risk owners, business stakeholders, information governance teams, and cybersecurity teams.

· Provide risk-based guidance that enables stakeholders to make informed decisions regarding risk acceptance, mitigation, transfer, or avoidance.

· Identify and recommend appropriate controls and risk treatment activities to effectively manage cybersecurity and information risks.

· Identify opportunities to improve the organization’s risk posture and assist in developing remediation and mitigation strategies.

· Assess residual risk following the implementation of mitigating or compensating controls.

· Track identified risks, issues, remediation activities, and risk events through closure.

· Support the execution of the third-party/vendor risk management lifecycle, including risk assessments, due diligence, control validation, ongoing monitoring, and remediation tracking.

· Support responses to external customer cybersecurity and information security questionnaires.

· Apply applicable legal, regulatory, contractual, and industry requirements when evaluating cybersecurity and third-party risks.

· Support risk reporting and documentation to provide appropriate visibility into material risks, issues, and remediation activities.

Requirements: A successful Global Cybersecurity Risk Analyst will demonstrate the following experience and competencies.

Education, Training, and Previous Experience

· Bachelor’s or master’s degree in business, Computer Science, Cybersecurity, Information Security, or a related field.

· 2 years of experience in cybersecurity, information security, technology risk, or a related risk management role.

· 2 years of experience managing risk and compliance matters or supporting applications, coordinating managed service provider activities, projects, systems, or third-party relationships requiring risk identification, assessment, remediation, and monitoring.

· Demonstrated understanding of operational, cybersecurity, information security, and technology risks.

· Strong business acumen with the ability to assess cybersecurity risks and potential impacts in the context of operational, financial, regulatory, and business objectives.

· Experience evaluating complex third-party risks through vendor risk management, information security, regulatory compliance, or audit activities.

· Hands-on experience using ServiceNow to perform and manage Vendor Risk Assessments.

· Experience working with recognized cybersecurity, risk, and compliance frameworks and methodologies, such as ISO/IEC 27001, COBIT, NIST Cybersecurity Framework, NIST SP 800-series guidance, and FAIR.

· Experience supporting or conducting cybersecurity risk assessments and documenting risk decisions.

Desired Certifications

The following certifications are preferred but not required:

· Certified Information Systems Security Professional (CISSP)

· Certified Information Security Manager (CISM)

· Certified Information Systems Auditor (CISA)

Knowledge and Skills

· Ability to conduct cybersecurity and information risk assessments, develop clear risk statements, and assess risk likelihood/frequency and potential impact.

· Ability to distinguish between risks, issues/findings, and control deficiencies, and evaluate how identified issues affect the likelihood or impact of associated risk entries in the Risk Register.

· Strong understanding of the components of risk, including assets, threats, vulnerabilities, business impacts, and controls, and how these elements interact to support risk-based decisions.

· Ability to evaluate control design and implementation and determine the effect of controls on inherent and residual risk.

· Ability to communicate cybersecurity risk findings to business and risk owners in a clear, objective, and fact-based manner that supports informed decision-making and balances risk mitigation with business objectives.

· Ability to translate technical cybersecurity concerns into meaningful business risk and impact.

· Understanding of organizational mission, values, objectives, and business priorities, with the ability to apply this context to risk decisions.

· Ability to manage multiple priorities simultaneously while gathering and evaluating information across different functions and stakeholders.

· Strong analytical and critical-thinking skills, with the ability to challenge assumptions and reach defensible, evidence-based risk conclusions.

· Ability to develop practical and innovative approaches to managing cybersecurity and information risk.

· Strong customer and business orientation, with a commitment to providing timely, efficient, and high-quality support.

· Ability to effectively influence stakeholders and facilitate appropriate risk management decisions.

· Excellent prioritization and organizational skills, including the ability to break complex work into manageable components and prioritize activities based on risk and business need.

· Strong decision-making capabilities, including the ability to evaluate the costs, benefits, and risk implications of potential courses of action.

· Strong problem-solving, analytical, and troubleshooting skills.

· Strong written and verbal communication skills.