Principal Cyber Risk Analyst - Remote

Job Overview The Principal Cyber Risk Analyst is responsible for leading the organization's enterprise cyber risk management program by identifying, assessing, prioritizing, and reporting technology and cybersecurity risks across the enterprise. This role serves as a strategic advisor to technology, cybersecurity, and business leadership by providing risk insights that support decision-making, risk treatment strategies, regulatory compliance, and organizational resilience. The position partners closely with cybersecurity, infrastructure, application, cloud, data, privacy, compliance, audit, and business stakeholders to establish a sustainable risk management framework, drive remediation efforts, measure risk reduction, and communicate risk posture to executive leadership and governance committees. Job Responsibilities Core Responsibilities Lead the identification, assessment, analysis, and prioritization of technology and cybersecurity risks across infrastructure, applications, cloud environments, operational technology, data platforms, and third-party ecosystemsEstablish and maintain an enterprise-wide cyber risk register, ensuring risks are accurately documented, quantified, monitored, and reportedProvide expert guidance on emerging technology risks, threat trends, and control weaknesses that may impact organizational objectivesTranslate complex technical risks into business-focused risk narratives, impacts, and mitigation strategies.Lead risk review meetings and challenge sessions with technology and business leaders to ensure risks are understood, accepted, mitigated, or escalated appropriatelyPartner with security, technology, and business teams to validate remediation plans and monitor progress toward risk reduction objectivesFacilitate discussions to remove barriers to remediation and ensure risk treatment activities align with enterprise prioritiesProvide oversight of cybersecurity risk assessments associated with vendors, service providers, and strategic technology partnersLead initiatives to enhance the organization's cyber risk management framework, methodology, tools, and reporting capabilitiesMentor junior analysts and provide thought leadership across the cyber risk management functionAct as a trusted advisor to senior technology leaders, cybersecurity leadership, risk officers, and business executivesPerforms other duties as assigned Job Requirements Education/ Certifications: Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business Administration, or related fieldOne or more preferred certifications:CISSPCRISCCISMCGEITCISAFAIR Certification Experience 10+ years of progressive experience in cybersecurity, information security, technology risk management, governance, risk and compliance (GRC), audit, or related disciplinesExperience leading enterprise cyber risk assessments and facilitating risk evaluations across infrastructure, cloud platforms, applications, data, operational technology, and third-party environmentsDemonstrated experience developing and managing cyber risk registers, issue management processes, risk treatment plans, and executive risk reportingExperience partnering with technology owners and business leaders to prioritize remediation activities based on risk exposure and business impactExperience supporting or leading regulatory, compliance, and audit initiatives including SOX, HIPAA, PCI-DSS, NIST, ISO 27001, and other relevant frameworksExperience presenting cybersecurity risks, trends, and remediation status to executive leadership, governance committees, and internal audit stakeholdersDemonstrated success leading strategic cybersecurity initiatives and influencing cross-functional teams without direct authorityExperience developing and maturing cybersecurity governance, risk assessment, risk quantification, and reporting methodologiesPrior experience mentoring analysts and leading enterprise-scale risk programs preferred Knowledge/Skills/Abilities Expert understanding of cybersecurity and risk management frameworks including NIST CSF, NIST RMF, COBIT, ISO 27001, CIS Controls, FAIR, and regulatory requirementsStrong knowledge of cybersecurity domains including identity management, network security, cloud security, application security, vulnerability management, data protection, disaster recovery, and third-party risk managementAbility to assess technical control deficiencies and translate findings into business risk statements understandable by executive leadershipAdvanced understanding of risk governance, risk quantification, risk treatment planning, issue management, and control effectiveness measurementExperience designing and implementing cyber risk metrics, key risk indicators (KRIs), and executive reporting dashboardsStrong facilitation and stakeholder management skills with demonstrated ability to drive consensus across technical and business teamsExceptional written and verbal communication skills with experience presenting risk information to senior leadership and executive committeesAbility to influence Director, VP, and executive-level stakeholders through data-driven risk analysis and recommendationsStrong business acumen with the ability to align cybersecurity investments and remediation activities to enterprise objectivesAbility to lead large-scale risk and governance initiatives with minimal direction.Strong analytical, critical thinking, and prioritization skillsAbility to establish risk-based decision frameworks that support remediation prioritization and resource allocationGood judgment is required for this position as there may be times when direct supervision may not be immediately available Work Environment Remote Role: This position is classified as remote where the associate will perform remote work from their primary residence. Remote associates are welcome to work from the office but are not required to do so. While remote associates are not required to work from an office on a regular basis, they may be required to come to the office or other UNFI locations for necessary business reasons or if directed to do so by their manager. Physical Environment/Demands Office Roles: Most work is performed in a temperature-controlled office environment. Incumbent may sit for long periods of time at a desk or computer terminal. While performing the duties of this job, the employee is regularly required to sit; use hands to finger, handle, or feel; reach with hands and arms; and talk or hear. Incumbent may use calculators, keyboards, telephones, and other office equipment in the course of a normal workday. Stooping, bending, twisting, and reaching may be required in the completion of job duties. The above statements are intended to describe the general nature of the work performed by the employees assigned to this job. All employees must comply with Company policy and applicable laws. The responsibilities, duties and skills required of personnel so classified may vary within each department and/or location. UNFI is an Equal Opportunity employer committed to creating an inclusive and respectful environment for all. All qualified applicants will receive equal consideration for employment without regard to race, color, age, religion, sex, sexual orientation, gender identity or expression, national origin, disability, protected veteran status, or other protected ground. Accommodation is available upon request for candidates taking part in all aspects of the job selection process. - Veteran/Disability. VEVRAA Federal Contractor. Compensation UNFI anticipates paying the above-referenced pay rate (or within the above-referenced pay range) for this position. Actual Pay, where applicable, will depend on a number of factors, including, but not limited to, education, experience, training, and any requirements under applicable collective bargaining agreements. UNFI is committed to transparency in pay in compliance with applicable state and local laws. Benefits For Washington positions (or positions that may be performed remotely from Washington), https://www.unfi.com/jobs-more-info-wa.html for Washington-specific paid time off details. Candidates hired into this position will also be eligible to participate in the following benefits programs: Paid Time Off; Sick Time; paid holidays and parental leave; 401K Program; medical, dental, vision, life, and accidental death/dismemberment insurance; short-term and long-term disability insurance program, Flexible Spending Account and/or Health Savings Account, subject to meeting the eligibility requirements and the terms and conditions of these programs, and subject to any requirements under applicable collective bargaining agreements. UNFI’s compensation, benefits, and paid time off policies are subject to change in the Company’s sole discretion, consistent with applicable law. This job posting should not be construed as an offer of employment with certain terms, nor should it be construed as a guaranteed minimum. Qualified applications with arrest or conviction records will be considered for employment in accordance with the Los Angeles County Fair Chance Ordinance and the California Fair Chance Act.