Cybersecurity Business Analyst — Data Risk – Multiple Offices (Hybrid)
Littler · Miami, FL · 1 mo ago
Hybrid$138k–$152k/yrFull-time
We need to output only HTML fragment, with headings for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. No Job ID etc. Remove boilerplate, navigation, legal, EEO, duplicated lines, application instructions. Also remove "No recruiters –principals only." etc. Also remove "For more information visit: ..."? That's maybe part of benefits? Actually there is a link for benefits. We can keep benefits content but not the link? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we should keep the benefits description but can we drop the link? The link is part of benefits info; maybe we keep it as part of benefits paragraph? It's not boilerplate? It's a URL for more info. Might be considered application instruction? Not exactly. But we can keep it as part of benefits description. However we need to remove "For more information visit: https://www.littler.com/benefits/state-details." That's a link to benefits details; maybe we keep it as part of benefits? The instruction says remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. This link is not exactly application instruction but could be considered reference. Might be okay to keep. However we also have "For more information about our firm visit: www.littler.com." That's likely boilerplate. Remove.
Also "No recruiters –principals only." etc is boilerplate. Remove.
Also "Please note applications are only accepted through our careers page ..." is application instruction; remove.
Also "For inquiries regarding this opportunity, please e-mail Jazmin Vivanco ..." is application instruction; remove.
Also "This job posting is a general description..." is boilerplate; remove.
Also "#BeYOUatLittler" maybe remove.
Now we need to identify sections:
- About the role: The first paragraph(s) describing role: "The Cybersecurity Business Analyst - Data Risk, is responsible for identifying, analyzing, and helping remediate risks to the firm's sensitive and regulated data throughout its lifecycle. The role bridges security, privacy, compliance, and business teams—translating data protection requirements into actionable controls, clear reporting, and prioritized risk decisions that reduce exposure while enabling the business. This is a hybrid position and can be resident in Phoenix, AZ; Atlanta, GA; Minneapolis, MN; Seattle, WA; Charlotte, NC; Miami or Orlando, FL; or Dallas, TX, with an onsite expectation of once per month. Pursuant to Washington and Minneapolis regulations, the salary range is $137,800 to $151,600 annually and includes eligibility for performance-based bonuses. Factors which may affect starting pay within this range may include geography/market, skills, education, experience and other qualifications of the successful candidate. We offer generous compensation and benefits packages."
That includes Pay info (salary range) and maybe Schedule (hybrid, onsite once per month). Also location info. So we can have sections: About the role (description), Responsibilities (list), Requirements (maybe combine with Qualifications? The posting has "Requirements, reporting, and analysis" as a subsection under responsibilities? Actually they have headings: Responsibilities (with subpoints), Requirements, reporting, and analysis (maybe part of responsibilities), Stakeholder enablement and collaboration, Qualifications, About Littler, Benefits.
We need to map to allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule.
We have content for About the role (first paragraph). Responsibilities: we have bullet points under "Data risk analysis and assessment", "Data governance and controls", "Requirements, reporting, and analysis", "Stakeholder enablement and collaboration". Those are responsibilities.
Requirements: maybe we have "Qualifications" section includes Preferred qualifications, Certifications. Could treat as Requirements? But we also have a separate Qualifications heading allowed. We'll put Requirements maybe empty? Better to combine qualifications into Qualifications section. The posting has "Qualifications" heading with Preferred qualifications and Certifications. Also there is "About Littler" which is company description; not needed as a section per allowed headings; we could drop it as not required. The instruction: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text. So we can omit About Littler if not needed. But we might include it under About the role? Not exactly. Better to omit.
Skills: maybe we can extract from Qualifications: "Experience in a legal, professional services, or other highly regulated environment.Familiarity with data governance and risk platforms (e.g., OneTrust, Microsoft Purview, ServiceNow).Comfort with data analysis and visualization tools (e.g., Excel / Power BI) and basic querying (e.g., SQL)." Those are skills. Also certifications are separate but could be under Qualifications.
Pay: we have salary range and bonus eligibility.
Schedule: hybrid position, onsite expectation once per month. Also location list maybe not schedule but we can include schedule info.
Benefits: we have benefits description.
Thus we will output sections: About the role, Responsibilities, Requirements (maybe we can put the qualifications as Requirements? But we also have Qualifications heading allowed. Let's use Requirements for the mandatory requirements? The posting doesn't have a separate "Requirements" section besides qualifications. We could treat Qualifications as Requirements. But we have both headings allowed; we can put Requirements empty? Better to use Qualifications for the qualifications/certifications, and maybe Requirements for the experience/skills? However the posting lumps them together under "Qualifications". To avoid thin sections, we can combine into Qualifications section and omit Requirements. But we need to follow instruction: Prefer a few substantive sections over many thin ones. So we can have About the role, Responsibilities, Qualifications, Benefits, Pay, Schedule. That's six sections.
We must not include Skills if we don't have separate content; we can incorporate skills into Qualifications.
Thus sections:
- About the role: include description (including hybrid, location, salary? Actually salary goes to Pay section; location maybe part of About the role? We'll keep location in About the role.
- Responsibilities: list of duties (bullet points). We'll combine the four responsibility categories into a list.
- Qualifications: include preferred qualifications, certifications.
- Benefits: description.
- Pay: salary range and bonus eligibility.
- Schedule: hybrid, onsite once per month.
We must not repeat job title as heading. Use
for sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. We must not repeat job title as heading. No Job ID etc. Remove boilerplate, navigation, legal, EEO, duplicated lines, application instructions. Also remove "No recruiters –principals only." etc. Also remove "For more information visit: ..."? That's maybe part of benefits? Actually there is a link for benefits. We can keep benefits content but not the link? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." So we should keep the benefits description but can we drop the link? The link is part of benefits info; maybe we keep it as part of benefits paragraph? It's not boilerplate? It's a URL for more info. Might be considered application instruction? Not exactly. But we can keep it as part of benefits description. However we need to remove "For more information visit: https://www.littler.com/benefits/state-details." That's a link to benefits details; maybe we keep it as part of benefits? The instruction says remove cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. This link is not exactly application instruction but could be considered reference. Might be okay to keep. However we also have "For more information about our firm visit: www.littler.com." That's likely boilerplate. Remove.
Also "No recruiters –principals only." etc is boilerplate. Remove.
Also "Please note applications are only accepted through our careers page ..." is application instruction; remove.
Also "For inquiries regarding this opportunity, please e-mail Jazmin Vivanco ..." is application instruction; remove.
Also "This job posting is a general description..." is boilerplate; remove.
Also "#BeYOUatLittler" maybe remove.
Now we need to identify sections:
- About the role: The first paragraph(s) describing role: "The Cybersecurity Business Analyst - Data Risk, is responsible for identifying, analyzing, and helping remediate risks to the firm's sensitive and regulated data throughout its lifecycle. The role bridges security, privacy, compliance, and business teams—translating data protection requirements into actionable controls, clear reporting, and prioritized risk decisions that reduce exposure while enabling the business. This is a hybrid position and can be resident in Phoenix, AZ; Atlanta, GA; Minneapolis, MN; Seattle, WA; Charlotte, NC; Miami or Orlando, FL; or Dallas, TX, with an onsite expectation of once per month. Pursuant to Washington and Minneapolis regulations, the salary range is $137,800 to $151,600 annually and includes eligibility for performance-based bonuses. Factors which may affect starting pay within this range may include geography/market, skills, education, experience and other qualifications of the successful candidate. We offer generous compensation and benefits packages."
That includes Pay info (salary range) and maybe Schedule (hybrid, onsite once per month). Also location info. So we can have sections: About the role (description), Responsibilities (list), Requirements (maybe combine with Qualifications? The posting has "Requirements, reporting, and analysis" as a subsection under responsibilities? Actually they have headings: Responsibilities (with subpoints), Requirements, reporting, and analysis (maybe part of responsibilities), Stakeholder enablement and collaboration, Qualifications, About Littler, Benefits.
We need to map to allowed headings: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule.
We have content for About the role (first paragraph). Responsibilities: we have bullet points under "Data risk analysis and assessment", "Data governance and controls", "Requirements, reporting, and analysis", "Stakeholder enablement and collaboration". Those are responsibilities.
Requirements: maybe we have "Qualifications" section includes Preferred qualifications, Certifications. Could treat as Requirements? But we also have a separate Qualifications heading allowed. We'll put Requirements maybe empty? Better to combine qualifications into Qualifications section. The posting has "Qualifications" heading with Preferred qualifications and Certifications. Also there is "About Littler" which is company description; not needed as a section per allowed headings; we could drop it as not required. The instruction: include a section ONLY when the posting has real, specific content for it — never emit a heading followed by filler/placeholder text. So we can omit About Littler if not needed. But we might include it under About the role? Not exactly. Better to omit.
Skills: maybe we can extract from Qualifications: "Experience in a legal, professional services, or other highly regulated environment.Familiarity with data governance and risk platforms (e.g., OneTrust, Microsoft Purview, ServiceNow).Comfort with data analysis and visualization tools (e.g., Excel / Power BI) and basic querying (e.g., SQL)." Those are skills. Also certifications are separate but could be under Qualifications.
Pay: we have salary range and bonus eligibility.
Schedule: hybrid position, onsite expectation once per month. Also location list maybe not schedule but we can include schedule info.
Benefits: we have benefits description.
Thus we will output sections: About the role, Responsibilities, Requirements (maybe we can put the qualifications as Requirements? But we also have Qualifications heading allowed. Let's use Requirements for the mandatory requirements? The posting doesn't have a separate "Requirements" section besides qualifications. We could treat Qualifications as Requirements. But we have both headings allowed; we can put Requirements empty? Better to use Qualifications for the qualifications/certifications, and maybe Requirements for the experience/skills? However the posting lumps them together under "Qualifications". To avoid thin sections, we can combine into Qualifications section and omit Requirements. But we need to follow instruction: Prefer a few substantive sections over many thin ones. So we can have About the role, Responsibilities, Qualifications, Benefits, Pay, Schedule. That's six sections.
We must not include Skills if we don't have separate content; we can incorporate skills into Qualifications.
Thus sections:
- About the role: include description (including hybrid, location, salary? Actually salary goes to Pay section; location maybe part of About the role? We'll keep location in About the role.
- Responsibilities: list of duties (bullet points). We'll combine the four responsibility categories into a list.
- Qualifications: include preferred qualifications, certifications.
- Benefits: description.
- Pay: salary range and bonus eligibility.
- Schedule: hybrid, onsite once per month.
We must not repeat job title as heading. Use for each section heading.
Use - for any list of duties/requirements/benefits. For Benefits we have a paragraph describing benefits; we could also make a list but it's prose. We'll keep as
.
For Pay we can put
with salary range.
For Schedule we can put
.
We must preserve all substantive information; not invent or summarize away detail. So we need to keep details like location list, salary numbers, bonus eligibility, factors affecting pay, benefits details (health, dental, vision, 401k, time off, mental health, family building, parental leave, life insurance, disability, wellness, flexible spending, employee referral bonus). Also we need to keep the link to benefits? Might be considered part of benefits; we can keep as part of benefits paragraph: "For more information visit: https://www.littler.com/benefits/state-details." That's a link; we can keep.
Also we need to keep the "We offer generous compensation and benefits packages." maybe duplicate.
We need to remove duplicated lines: there is a duplicate benefits link later; we can keep one.
Also remove "For more information about our firm visit: www.littler.com." Remove.
Also remove "No recruiters –principals only." etc.
Also remove "Please note applications are only accepted through our careers page ..." etc.
Also remove "For inquiries regarding this opportunity, please e-mail Jazmin Vivanco ..." etc.
Also remove "This job posting is a general description..." etc.
Also remove "#BeYOUatLittler".
Now craft HTML.
We'll start with
About the role
then ...
.
Include location list: "Phoenix, AZ; Atlanta, GA; Minneapolis, MN; Seattle, WA; Charlotte, NC; Miami or Orlando, FL; or Dallas, TX". Also mention hybrid position and onsite expectation once per month? Actually schedule will be separate; but we can mention hybrid in About the role? Might duplicate. Better to keep location and hybrid in About the role, and schedule details in Schedule section.
Thus About the role paragraph: "The Cybersecurity Business Analyst - Data Risk is responsible for identifying, analyzing, and helping remediate risks to the firm's sensitive and regulated data throughout its lifecycle. The role bridges security, privacy, compliance, and business teams—translating data protection requirements into actionable controls, clear reporting, and prioritized risk decisions that reduce exposure while enabling the business. This is a hybrid position and can be resident in Phoenix, AZ; Atlanta, GA; Minneapolis, MN; Seattle, WA; Charlotte, NC; Miami or Orlando, FL; or Dallas, TX."
We could also mention that we offer generous compensation and benefits packages but that's covered in Benefits and Pay sections.
Now Responsibilities: we need to list all duties from the four categories.
Let's extract bullet points:
Data risk analysis and assessment:
- Maintain an inventory of sensitive and regulated data, data flows, systems, and third-party sharing.
- Conduct data risk assessments covering confidentiality, integrity, availability, and regulatory exposure.
- Analyze data classification, access, retention, and handling to identify gaps and control weaknesses.
- Quantify and prioritize data risks, and track remediation activities through to closure.
Data governance and controls:
- Support data classification, DLP, and data protection policies and standards.
- Translate privacy and regulatory requirements (e.g., GDPR, CCPA, HIPAA where applicable) into data control requirements.
- Partner with control owners to define, document, and validate data safeguards.
- Monitor control effectiveness and produce metrics on the firm’s data risk posture.
Requirements, reporting, and analysis:
- Gather and document business and security requirements for data protection initiatives.
- Build dashboards and reports on data risk, exposure, and remediation progress for leadership.
- Perform root-cause and trend analysis on data incidents, DLP alerts, and access anomalies.
- Support audits and client assessments with data risk evidence and documentation.
Stakeholder enablement and collaboration:
- Serve as a liaison between Security, Privacy, Risk, IT, and business stakeholders.
- Translate technical data risks into clear business language and actionable recommendations.
- Provide guidance that helps teams handle data safely and meet compliance obligations.
- Support response to data-related incidents, findings, and control failures.
We'll combine into a single - list.
Now Qualifications: include Preferred qualifications and Certifications.
Preferred qualifications:
- Experience in a legal, professional services, or other highly regulated environment.
- Familiarity with data governance and risk platforms (e.g., OneTrust, Microsoft Purview, ServiceNow).
- Comfort with data analysis and visualization tools (e.g., Excel / Power BI) and basic querying (e.g., SQL).
Certifications:
- Core security / risk: CISM, CRISC, or CISSP.
- Data / privacy: CIPP, CIPM, or CDPSE.
- Governance / analysis: ISO/IEC 27001 lead implementer/auditor or a recognized business analysis certification (e.g., CBAP).
We'll put as
- .
Now Benefits: paragraph describing benefits.
We need to preserve all substantive information: "We offer a generous benefits package to full-time and part-time employees working at least a 50% schedule. Benefits include comprehensive health, dental and vision plan for you, your spouse/domestic partner and children. In addition, we provide a superior 401(k) plan, ample time off programs,
- for any list of duties/requirements/benefits. For Benefits we have a paragraph describing benefits; we could also make a list but it's prose. We'll keep as
. For Pay we can put
with salary range. For Schedule we can put
. We must preserve all substantive information; not invent or summarize away detail. So we need to keep details like location list, salary numbers, bonus eligibility, factors affecting pay, benefits details (health, dental, vision, 401k, time off, mental health, family building, parental leave, life insurance, disability, wellness, flexible spending, employee referral bonus). Also we need to keep the link to benefits? Might be considered part of benefits; we can keep as part of benefits paragraph: "For more information visit: https://www.littler.com/benefits/state-details." That's a link; we can keep. Also we need to keep the "We offer generous compensation and benefits packages." maybe duplicate. We need to remove duplicated lines: there is a duplicate benefits link later; we can keep one. Also remove "For more information about our firm visit: www.littler.com." Remove. Also remove "No recruiters –principals only." etc. Also remove "Please note applications are only accepted through our careers page ..." etc. Also remove "For inquiries regarding this opportunity, please e-mail Jazmin Vivanco ..." etc. Also remove "This job posting is a general description..." etc. Also remove "#BeYOUatLittler". Now craft HTML. We'll start with
About the role
then...
. Include location list: "Phoenix, AZ; Atlanta, GA; Minneapolis, MN; Seattle, WA; Charlotte, NC; Miami or Orlando, FL; or Dallas, TX". Also mention hybrid position and onsite expectation once per month? Actually schedule will be separate; but we can mention hybrid in About the role? Might duplicate. Better to keep location and hybrid in About the role, and schedule details in Schedule section. Thus About the role paragraph: "The Cybersecurity Business Analyst - Data Risk is responsible for identifying, analyzing, and helping remediate risks to the firm's sensitive and regulated data throughout its lifecycle. The role bridges security, privacy, compliance, and business teams—translating data protection requirements into actionable controls, clear reporting, and prioritized risk decisions that reduce exposure while enabling the business. This is a hybrid position and can be resident in Phoenix, AZ; Atlanta, GA; Minneapolis, MN; Seattle, WA; Charlotte, NC; Miami or Orlando, FL; or Dallas, TX." We could also mention that we offer generous compensation and benefits packages but that's covered in Benefits and Pay sections. Now Responsibilities: we need to list all duties from the four categories. Let's extract bullet points: Data risk analysis and assessment: - Maintain an inventory of sensitive and regulated data, data flows, systems, and third-party sharing. - Conduct data risk assessments covering confidentiality, integrity, availability, and regulatory exposure. - Analyze data classification, access, retention, and handling to identify gaps and control weaknesses. - Quantify and prioritize data risks, and track remediation activities through to closure. Data governance and controls: - Support data classification, DLP, and data protection policies and standards. - Translate privacy and regulatory requirements (e.g., GDPR, CCPA, HIPAA where applicable) into data control requirements. - Partner with control owners to define, document, and validate data safeguards. - Monitor control effectiveness and produce metrics on the firm’s data risk posture. Requirements, reporting, and analysis: - Gather and document business and security requirements for data protection initiatives. - Build dashboards and reports on data risk, exposure, and remediation progress for leadership. - Perform root-cause and trend analysis on data incidents, DLP alerts, and access anomalies. - Support audits and client assessments with data risk evidence and documentation. Stakeholder enablement and collaboration: - Serve as a liaison between Security, Privacy, Risk, IT, and business stakeholders. - Translate technical data risks into clear business language and actionable recommendations. - Provide guidance that helps teams handle data safely and meet compliance obligations. - Support response to data-related incidents, findings, and control failures. We'll combine into a single- list.
Now Qualifications: include Preferred qualifications and Certifications.
Preferred qualifications:
- Experience in a legal, professional services, or other highly regulated environment.
- Familiarity with data governance and risk platforms (e.g., OneTrust, Microsoft Purview, ServiceNow).
- Comfort with data analysis and visualization tools (e.g., Excel / Power BI) and basic querying (e.g., SQL).
Certifications:
- Core security / risk: CISM, CRISC, or CISSP.
- Data / privacy: CIPP, CIPM, or CDPSE.
- Governance / analysis: ISO/IEC 27001 lead implementer/auditor or a recognized business analysis certification (e.g., CBAP).
We'll put as
- . Now Benefits: paragraph describing benefits. We need to preserve all substantive information: "We offer a generous benefits package to full-time and part-time employees working at least a 50% schedule. Benefits include comprehensive health, dental and vision plan for you, your spouse/domestic partner and children. In addition, we provide a superior 401(k) plan, ample time off programs,
- list.
Now Qualifications: include Preferred qualifications and Certifications.
Preferred qualifications:
- Experience in a legal, professional services, or other highly regulated environment.
- Familiarity with data governance and risk platforms (e.g., OneTrust, Microsoft Purview, ServiceNow).
- Comfort with data analysis and visualization tools (e.g., Excel / Power BI) and basic querying (e.g., SQL).
Certifications:
- Core security / risk: CISM, CRISC, or CISSP.
- Data / privacy: CIPP, CIPM, or CDPSE.
- Governance / analysis: ISO/IEC 27001 lead implementer/auditor or a recognized business analysis certification (e.g., CBAP).
We'll put as