Risk Specialist

Focus Financial Partners is seeking a proactive and detail-oriented Senior Risk Operations Specialist to support and strengthen our organization’s Cybersecurity program. This role is based in New York, NY or St. Louis, MO.

About the role

This position supports key risk pillars: Vulnerability Management and Risk Management. The successful candidate will assist with writing policy and process, supporting deployment of technology, handling incident response, and managing cybersecurity dashboards to track key performance indicators (KPIs) across all partner firms.

Responsibilities

• Analyze vulnerability assessments and third-party security reviews, considering environmental, procedural, and business risk factors—not just technical severity scores.
• Partner with Infrastructure, Security Engineering, Enterprise Risk Management, Vendor Management, Legal, Compliance, Procurement, and business stakeholders to identify, assess, and mitigate cybersecurity risk.
• Manage the lifecycle of vulnerabilities and third-party risks by tracking findings, driving remediation efforts, facilitating risk acceptance, and validating issue resolution.
• Conduct cybersecurity due diligence for new and existing vendors, evaluate security controls, and recommend practical risk mitigation strategies and compensating controls.
• Develop and maintain third-party risk management (TPRM) policies, procedures, vendor assessment questionnaires, and governance processes.
• Drive remediation initiatives for end-of-life and unsupported technologies, vendor security gaps, and other identified cyber risks.
• Assist in developing threat intelligence and exposure management processes to identify emerging risks affecting the organization and its third-party ecosystem.
• Develop, track, and report cybersecurity and third-party risk metrics, including Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs), to leadership.
• Support regulatory, audit, and compliance initiatives by ensuring cybersecurity and third-party risk practices align with applicable regulations and industry frameworks.
• Build strong relationships with internal stakeholders and third-party partners to promote effective risk management and continuous improvement across the cybersecurity program.

Requirements

• 3–5 years of experience in cybersecurity risk management, vulnerability management, third-party risk management, or a related cybersecurity discipline.
• Experience analyzing vulnerabilities, conducting vendor security assessments, and managing remediation efforts across technical and business stakeholders.
• Knowledge of the vulnerability management lifecycle, including discovery, validation, prioritization, remediation, verification, exception management, and risk acceptance.
• Familiarity with cybersecurity frameworks such as NIST CSF, ISO 27001, or similar industry standards.
• Experience with vulnerability and exposure management platforms such as Rapid7, Tenable, Qualys, CrowdStrike, or similar tools.
• Knowledge of financial services regulations and security requirements, including SEC, FINRA, Regulation S-P, GDPR, and CCPA.
• Strong analytical, communication, and relationship management skills with the ability to influence technical and non-technical stakeholders.
• Ability to manage multiple priorities in a fast-paced, highly collaborative environment.

Qualifications

• Industry certifications such as CISSP, CISM, or GIAC certifications are preferred.
• Prior experience in a financial services or multi-partner environment is preferred.

Pay

The annualized base pay range for this role is $100,000–$130,000. Actual base pay may vary based on factors including experience, subject matter expertise, geographic location, and skill set. The base pay is one component of the total compensation package, which may also include an annual cash bonus and a comprehensive benefits package.

Benefits

• Medical, dental, and vision insurance
• Life insurance
• 401(k)