Information Security Risk Analyst

About the role

It’s an exciting time to join Fisher Investments; we’re investing in the future of our firm’s technology and information security. Our business is growing internationally, emphasizing the need to build an unparalleled team that promotes global growth through strategic solutions and progress. The Information Security Risk Analyst reports to the Vice President – Information Security and works with Information Security, Technology, Project, and Enterprise Risk Management teams to perform technology risk analysis, recommend controls, and develop risk practices aligned with Fisher Investments’ Digital Asset risk management goals.

Responsibilities

• Represent Information Security in Enterprise Risk Management technology reviews for Digital Assets, including evaluation of inherent risk, researching vendor practices and controls, recommending new practices and controls, and estimating residual risk.
• Continuously collaborate with Information Security, Technology, and Data Privacy Subject Matter Experts to determine efficacy of technical and practical Digital Asset controls.
• Research new possible technical and practical Digital Asset risk controls.
• Perform security‑focused risk and gap assessments to identify, document, and track security risks associated with cloud and physical IT infrastructure and services, applications, information systems, and vendors/other third parties.
• Identify risk levels and associated controls to manage risk levels using both quantitative and qualitative techniques.
• Assist in continuously maturing Enterprise Risk Management evaluation procedures for Digital Assets.
• Translate risk management information from technical to business language.
• Provide security risk services to business owners and partners.
• Work with project teams to collect and document evidence of cyber control implementation.
• Maintain a broad knowledge of methodologies and technologies in risk assessments and control measures.

Qualifications

• Bachelor’s degree in computer science, Information Security, or related discipline, or equivalent experience.
• 3+ years of experience in Enterprise Risk Management for Digital Assets, including development of risk evaluation processes, control evaluations and recommendations, and vendor research.
• 1+ years of experience in Digital Asset audit review (including SOC 2 Type II, SOX compliance, PCI compliance, vulnerability reports, retention policies).
• Knowledge of information‑security and risk standards/frameworks such as NIST 800‑53, CIS benchmarks, OWASP, ISO‑27001, ITIL, and COSO.
• Experience assessing risk or implementing controls in a cloud‑based enterprise environment.
• Extensive knowledge of information systems, risk‑assessment methodologies, and security‑control technologies such as Okta, Entra ID, Splunk, and Netskope.
• Ability to balance risks in ambiguous and complex scenarios.
• Team‑oriented, highly collaborative, with experience leading initiatives.
• Experience with GRC platforms.
• Deliver quality as part of a Scrum team working in an Agile environment.
• Preference given to experience in a regulated industry (e.g., finance, healthcare).

Pay

$80,200 – $130,000 base salary per year in Washington state. New hires are expected to start at the lower end of the range depending on experience. Eligible for a discretionary bonus based on firm and individual performance.

Benefits

• 100% paid medical, dental, and vision premiums for you and qualifying dependents.
• 50% 401(k) match, up to the IRS maximum.
• 20 days of PTO, plus 10 paid holidays.
• Family support programs including an 8‑week paid primary caregiver leave, $10,000 assistance for fertility, family‑forming, and hormonal health, and backup child, adult, and elder care.
• In‑office role with the possibility of participating in a hybrid work‑from‑home program based on role, tenure, and performance (subject to change).