Senior Cybersecurity Governance Analyst

About the role

The Senior Cybersecurity Governance Analyst provides second-line oversight of the organization’s cybersecurity risk management program by leading security architecture governance, threat-informed risk analysis, vulnerability management oversight, and independent security assurance activities.

This role ensures cybersecurity risks are identified, evaluated, communicated, and managed in alignment with the organization's risk appetite, regulatory requirements, and strategic objectives. The Senior Cybersecurity Governance Analyst serves as a key advisor to technology, business, and risk stakeholders by providing independent challenge, governance oversight, and risk-informed recommendations to strengthen the organization’s overall cybersecurity posture.

Responsibilities

• Conduct independent, risk-based reviews of system, network, application, cloud, and third-party architectures to identify cybersecurity risks and evaluate alignment with security policies, standards, and secure-by-design principles.
• Provide governance oversight of network segmentation, identity management, cloud security, and infrastructure security initiatives, identifying risks and recommending appropriate mitigating controls.
• Participate in project governance and system development lifecycle processes to ensure cybersecurity risks are identified, assessed, and addressed throughout technology initiatives.
• Perform cybersecurity risk assessments for technology initiatives, applications, infrastructure changes, and third-party services, evaluating threats, vulnerabilities, control effectiveness, and residual risk exposure.
• Facilitate risk acceptance, exception management, and remediation tracking processes, ensuring cybersecurity risks are appropriately documented, communicated, and managed in alignment with organizational risk tolerance.
• Support enterprise and operational risk management activities through risk analysis, reporting, and communication.
• Monitor and assess relevant threat intelligence sources and industry threat activity to identify emerging cyber threats and evaluate potential impacts on organizational risk exposure.
• Translate threat intelligence into risk informed recommendations for control enhancements, mitigation strategies, and cybersecurity planning.
• Develop and maintain cybersecurity metrics, dashboards, risk reporting, policies, standards, and control frameworks, while contributing to cybersecurity strategy, maturity improvement initiatives, and governance committee activities as a subject matter expert on cybersecurity risk and governance matters.
• Display integrity, self-awareness, courage, and respect for staff while ensuring learning agility and flexibility communicating and delegating effectively.
• Work effectively, collaboratively, and creatively in a team-oriented environment both internally and externally.

Qualifications

• Minimum of 7-9 years of experience in cybersecurity governance, risk management, security architecture, security assurance, vulnerability management, or related disciplines.
• Strong understanding of cybersecurity frameworks including NIST Cybersecurity Framework (CSF), NIST SP 800-53, FFIEC ACET, CIS Controls, and industry best practices.
• Experience conducting cybersecurity risk assessments and evaluating control effectiveness.
• Knowledge of secure architecture principles across cloud, network, application, and identity platforms.
• Understanding of threat intelligence, vulnerability management, and cybersecurity risk analysis methodologies.
• Experience supporting audits, regulatory examinations, and compliance initiatives.
• Strong analytical, communication, presentation, and report writing skills.
• Ability to function in a Consumer business office environment and utilize standard office equipment including but not limited to: PC, copier, telephone, etc.
• Ability to lift a minimum of 25 lbs. (file boxes, computer).
• Travel required on occasion.

Preferred Qualifications

• BA/BS degree in Cybersecurity, Information Technology, Information Systems, Risk Management, or a related field.
• Experience in financial services, credit unions, or highly regulated industries.
• Familiarity with threat intelligence frameworks, MITRE ATT&CK, CVSS, and EPSS.
• Experience supporting board or executive-level cybersecurity reporting.
• Professional certifications such as CISSP, CRISC, CISM, CGRC, CISA, and/or GIAC (GCTI, GSEC, or equivalent).