Cyber Risk Management Analyst

Key Responsibilities Identify and assess cybersecurity risks across applications, infrastructure, third parties, and business processes. Conduct cyber risk assessments, control assessments, and risk reviews. Maintain and monitor the organization's cybersecurity risk register. Evaluate security controls against frameworks such as NIST CSF, NIST 800-53, ISO 27001, CIS Controls, and SOC 2. Identify control gaps, document findings, and work with control owners to develop remediation plans. Track cybersecurity issues, vulnerabilities, exceptions, and remediation activities through closure. Support third-party/vendor cybersecurity risk assessments. Review security questionnaires, audit reports, penetration-testing results, and other security documentation. Assist with cybersecurity governance, risk, and compliance (GRC) activities. Prepare risk reports, dashboards, metrics, and management presentations. Support internal and external audits and regulatory examinations. Monitor changes in the threat landscape and assess their potential business impact. Assist with risk acceptance, exception management, and compensating-control reviews. Help develop and maintain cybersecurity policies, standards, procedures, and control documentation. Collaborate with Security, IT, Legal, Compliance, Internal Audit, Privacy, and business teams. Required Qualifications Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, or a related field. 5+ years of experience in cybersecurity, IT risk, GRC, IT audit, compliance, or a related discipline. Knowledge of cybersecurity risk-management principles and security controls. Experience with risk assessments, control testing, issue management, and remediation tracking. Familiarity with security frameworks such as NIST, ISO 27001, CIS Controls, SOC 2, or COBIT. Strong analytical, documentation, communication, and problem-solving skills. Ability to translate technical cybersecurity risks into business-impact language. Preferred Qualifications Experience with GRC platforms such as ServiceNow GRC, Archer, RSA, MetricStream, or OneTrust. Relevant certifications such as CRISC, CISA, CISSP, CISM, Security+, or ISO 27001. Experience with third-party/vendor risk management. Knowledge of cloud security risks involving AWS, Azure, or GCP. Familiarity with vulnerability management, penetration testing, identity and access management, incident response, and security architecture. Understanding of privacy and regulatory requirements relevant to the organization's industry. Skills: risk management,management,cybersecurity,risk,security,it,documentation,cyber,iso,grc