What are the responsibilities and job description for the Cyber Risk Management Analyst position at Staffing Spot, Inc.?
Key Responsibilities
- Identify and assess cybersecurity risks across applications, infrastructure, third parties, and business processes.
- Conduct cyber risk assessments, control assessments, and risk reviews.
- Maintain and monitor the organization's cybersecurity risk register.
- Evaluate security controls against frameworks such as NIST CSF, NIST 800-53, ISO 27001, CIS Controls, and SOC 2.
- Identify control gaps, document findings, and work with control owners to develop remediation plans.
- Track cybersecurity issues, vulnerabilities, exceptions, and remediation activities through closure.
- Support third-party/vendor cybersecurity risk assessments.
- Review security questionnaires, audit reports, penetration-testing results, and other security documentation.
- Assist with cybersecurity governance, risk, and compliance (GRC) activities.
- Prepare risk reports, dashboards, metrics, and management presentations.
- Support internal and external audits and regulatory examinations.
- Monitor changes in the threat landscape and assess their potential business impact.
- Assist with risk acceptance, exception management, and compensating-control reviews.
- Help develop and maintain cybersecurity policies, standards, procedures, and control documentation.
- Collaborate with Security, IT, Legal, Compliance, Internal Audit, Privacy, and business teams.
- Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or a related field.
- 5 years of experience in cybersecurity, IT risk, GRC, IT audit, compliance, or a related discipline.
- Knowledge of cybersecurity risk-management principles and security controls.
- Experience with risk assessments, control testing, issue management, and remediation tracking.
- Familiarity with security frameworks such as NIST, ISO 27001, CIS Controls, SOC 2, or COBIT.
- Strong analytical, documentation, communication, and problem-solving skills.
- Ability to translate technical cybersecurity risks into business-impact language.
- Experience with GRC platforms such as ServiceNow GRC, Archer, RSA, MetricStream, or OneTrust.
- Relevant certifications such as CRISC, CISA, CISSP, CISM, Security , or ISO 27001.
- Experience with third-party/vendor risk management.
- Knowledge of cloud security risks involving AWS, Azure, or GCP.
- Familiarity with vulnerability management, penetration testing, identity and access management, incident response, and security architecture.
- Understanding of privacy and regulatory requirements relevant to the organization's industry.
Salary : $60 - $70