Information Security Risk Analyst

About the role

The Information Security Risk Management Analyst supports the confidentiality, integrity, and availability of the credit union’s processes, procedures, and systems by assisting with information security risk management activities. This role partners with departments across the credit union to promote security best practices, support risk assessment and compliance efforts, and help ensure processes, controls, and configurations align with established information security requirements.

First Tech and DCU were founded on the belief that financial solutions should put people first. That belief has fueled decades of innovation and service, rooted in the tech sector and expanding to support members from all walks of life. Every great journey begins with a bold idea—and ours is no different.

Responsibilities

• Support the Information Security Risk Team and Management in developing and performing governance, risk, and compliance deliverables.
• Assist in conducting risk assessments on systems, applications, vendors, and business processes.
• Support the documentation and tracking of identified risks, mitigation plans, and remediation efforts.
• Participate in third-party/vendor risk assessments and due diligence reviews.
• Assist in the development and maintenance of security policies, standards, and procedures.
• Collaborate with IT and business units to gather information and support risk mitigation efforts.
• Contribute to internal audits, control testing, and security awareness initiatives as needed.
• Support security awareness initiatives, including employee communications, training activities, phishing education, and related program support.
• Complete recurring operational security tasks related to compliance, data loss prevention, phishing response, and other security program support activities.
• Monitor regulatory and industry developments to help support compliance with control frameworks such as NIST, CIS Controls, and the Cloud Controls Matrix (CCM).
• Maintain current knowledge of the information security industry, including security controls, improved security processes, emerging attacks, and evolving threat vectors.

Requirements

• Education: Bachelor’s degree in a field relevant to the role (or 4 additional years of relevant experience in lieu of a degree)
• Experience: 2+ years of relevant experience
• Experience in risk, compliance, or operational roles

Qualifications

• Familiarity with information security risk management, compliance activities, security tools, and control frameworks
• Basic knowledge of regulatory requirements applicable to financial institutions
• Ability to adapt to changes