Associate Cyber Risk Analyst

About the role

The Associate Cyber Risk Analyst coordinates governance, risk, and compliance activities that support UFCU’s cybersecurity program. This role organizes participation in internal audits and third-party due diligence, maintains cybersecurity program knowledge and records, coordinates the development and lifecycle of security processes and procedures, and administers the security awareness training and phishing exercise program. The Associate Cyber Risk Analyst partners with Information Security, Risk Management, Internal Audit, Compliance, Legal, Human Resources, Technology, and business teams to collect evidence, track commitments, improve documentation, and promote secure behaviors across the organization. The Associate Cyber Risk Analyst is an exempt position and reports to the Director, Information Security, and is part of the Information Security team at UFCU.

Responsibilities

• Coordinate, organize, and manage Information Technology participation in internal audits, external audits, regulatory examinations, risk assessments, and control reviews.
• Maintain audit schedules, evidence inventories, request lists, stakeholder assignments, due dates, dependencies, and status reporting from initiation through closure.
• Collect, review, organize, and securely retain audit evidence to support accurate, complete, and timely responses.
• Facilitate meetings among auditors, vendors, control owners, subject matter experts, and leadership; document decisions, action items, and follow-up commitments.
• Track findings, management responses, remediation plans, and evidence of closure; escalate delays, risks, and resource constraints to Information Security leadership.
• Maintain the cybersecurity program’s authoritative documentation repository, including standards, procedures, control narratives, evidence, risk records, decisions, meeting materials, metrics, and program artifacts.
• Organize cybersecurity information using consistent taxonomy, naming, ownership, version control, retention, review dates, and access permissions.
• Coordinate recurring reviews with document owners to validate accuracy, remove obsolete content, and preserve institutional knowledge.
• Prepare dashboards, reports, presentations, and program updates that communicate cybersecurity activities, risks, trends, and commitments to technical and business audiences.
• Support records retention, legal hold, privacy, and confidentiality requirements for cybersecurity program information.
• Coordinate the development, review, approval, publication, and scheduled refresh of Information Security processes, procedures, standards, and supporting templates.
• Partner with process owners and subject matter experts to document roles, workflows, control points, inputs, outputs, dependencies, exceptions, and evidence requirements.
• Facilitate workshops and working sessions to identify gaps, resolve conflicting requirements, and align documentation with policy, risk, regulatory, and operational needs.
• Maintain document inventories, ownership assignments, approval records, revision history, review cadence, and exceptions.
• Monitor process adoption and effectiveness; recommend improvements based on audit results, incidents, metrics, stakeholder feedback, and changes in the threat or regulatory environment.
• Administer the enterprise security awareness and training program, including annual training, role-based learning, new-hire content, targeted campaigns, and recurring communications.
• Plan and execute periodic phishing simulations with approved scenarios, audience groups, schedules, safeguards, and escalation paths.
• Maintain training assignments, completion records, exceptions, reminders, and evidence required for audits and regulatory reviews.
• Analyze training and phishing results, identify trends and