Sr Risk Analyst

We need to output HTML fragment with sections: About the role? Actually the posting includes "Job Description" and then details. We need headings for sections like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes: About Informa TechTarget (company description) maybe not needed? The instruction: "use

for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule)." So we can create sections: About the role (maybe from Job Description intro?), Responsibilities (list of duties), Requirements (maybe Required Qualifications?), Qualifications (maybe Preferred Qualifications?), Skills (Cybersecurity & Technical Skills and Professional Skills?), Benefits (the Additional Information includes benefits), Pay (not present), Schedule (not present). We must not create sections with placeholder text. So we omit Pay and Schedule. We need to preserve all substantive information, not invent or summarize away detail. Use

• for any list of duties/requirements/benefits, and

  for prose. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning boilerplate, duplicated lines, and application instructions. Also remove repeated lines like "For more information, visit informatechtarget.com and follow us on LinkedIn." duplicated. We need to include the job location: "This role is based in our Newton, MA office." That's substantive; could be part of About the role paragraph. We need to include the company description maybe as part of About the role? The instruction says "About the role" heading; we can put a paragraph describing the role and maybe company context. We must not repeat the job title as a heading. The job title is Senior Cyber Risk Analyst; we should not put that as heading. We need to include the list of responsibilities from "Key Responsibilities" sections. Those are many bullet-like sentences. We'll turn each into

• under a
  inside Responsibilities section. We need to include Required Qualifications (Education & Experience, Certifications). We'll put under Requirements maybe? The instruction includes Requirements and Qualifications separate headings. We could put Required Qualifications under Requirements, and Preferred Qualifications under Qualifications. Or we could combine. But we need to follow instruction: use headings as given. We'll create:

  About the role

  ...

  Responsibilities

  ...

  Requirements

  ...
  (for required qualifications)

  Qualifications

  ...
  (for preferred qualifications)

  Skills

  Maybe split into two sublists? Could combine Cybersecurity & Technical Skills and Professional Skills into one list? But better to keep as two
  under Skills? The instruction says use
  • for any list of duties/requirements/benefits. So we can have multiple lists under Skills heading.

    Benefits

    ...
    from Additional Information benefits. We must not include boilerplate like EEO statements, etc. Also remove duplicated lines like "Visit informatechtarget.com and follow us on LinkedIn." repeated. We need to preserve all substantive information: include details about company reach, etc? That's maybe not needed for role but could be part of About the role? The instruction says preserve ALL substantive information; do NOT invent or summarize away detail. So we should include the company description maybe in About the role paragraph. However, the "About Informa TechTarget" section is substantive about the company; we could include it there. But we must avoid duplication: there is also a line "Visit informatechtarget.com and follow us on LinkedIn." appears twice; we should keep only once maybe? But it's considered boilerplate? It's not exactly boilerplate but it's a call to action; maybe we should remove as it's like application instructions? The instruction says remove duplicated lines, and application instructions. This line is not exactly application instruction but it's a promotional line; could be considered boilerplate? Safer to remove it. We also need to remove the "Additional Information" heading that includes EEO etc. We'll keep only benefits part. Let's extract content. Company description: "Informa TechTarget (Nasdaq: TTGT) informs, influences and connects the world’s technology buyers and sellers, to accelerate growth from R&D to ROI. With an unparalleled reach of over 220 highly targeted technology-specific websites and more than 50 million permissioned first-party audience members, Informa TechTarget has a unique understanding of and insight into technology markets. Underpinned by those audiences and their data, we offer expert-led, data-driven, and digitally enabled services that deliver significant impact and measurable outcomes to our clients. We provide our customers with: Trusted information that shapes the industry and informs investmentIntelligence and advice that guides and influences strategyAdvertising that grows reputation and establishes thought leadershipCustom content that engages and prompts actionIntent and demand generation that more precisely targets and convertsOur organization is committed to sustainability, diversity, wellbeing, and ethical working practices." Note there are missing spaces after colons? We'll keep as is but maybe add spaces for readability? We must not invent or summarize away detail; we can keep the text exactly but maybe fix missing spaces? That would be altering content. Better to keep as given, but it's hard to read. However we can keep as is; it's still substantive. Job location: "This role is based in our Newton, MA office." Job description intro: "Do you want to develop your career and make an impact in the fast-growth, fast-moving B2B technology space? At Informa TechTarget, you’ll collaborate and grow alongside some of the industry’s most respected experts. You’ll work with leading brands and be exposed to world-shaping innovations. You’ll apply your energy and intellect to helping clients be faster to market and faster to revenue. We’re a vibrant community of world-class practitioners – over 2000 colleagues strong – with offices in 19 locations around the world. We’re traded on Nasdaq and also part of Informa PLC, a global leader in business-to-business events, digital services, and academic research in the FTSE 100." We can combine that into About the role paragraph. Now Responsibilities: list from "Key Responsibilities". We'll extract each bullet line. Let's list them: - Lead comprehensive enterprise-wide cyber risk assessments across all business operations, systems, and infrastructure - Identify, analyze, and evaluate cybersecurity risks including threats, vulnerabilities, and potential business impacts - Develop and maintain enterprise risk registers, ensuring all cyber risks are properly documented, prioritized, and monitored - Create and implement risk treatment plans and mitigation strategies to reduce organizational exposure - Conduct risk assessments for new technologies, systems, and business initiatives in partnership with engineering and product teams - Utilize risk management frameworks (NIST CSF, ISO 27005, FAIR) to quantify and communicate risk - Cloud Security & Infrastructure Risk Assess security risks associated with cloud environments (AWS, Azure, GCP) and hybrid infrastructure - Evaluate cloud architecture designs and configurations for security and compliance risks - Partner with cloud engineering teams to implement security controls and risk mitigation measures - Review and assess risks related to cloud migration projects and infrastructure changes - Vulnerability & Threat Management Oversee vulnerability management program effectiveness and risk prioritization - Analyze vulnerability scan results and penetration test findings to assess enterprise risk exposure - Work with IT and security teams to ensure timely remediation of critical vulnerabilities - Monitor threat intelligence and assess potential impact to the organization - Evaluate the effectiveness of security controls in mitigating identified vulnerabilities - Third-Party & Vendor Risk Management Conduct cybersecurity risk assessments of third-party vendors, suppliers, and business partners - Review vendor security questionnaires, certifications, and audit reports - Assess risks associated with vendor access to systems and data - Monitor ongoing third-party risk and ensure compliance with security requirements - Support vendor risk remediation efforts and contract security requirements - Governance, Compliance & Policy Ensure compliance with relevant cybersecurity regulations, standards, and frameworks (SOC 2, ISO 27001, NIST, Sox, etc.) - Support the development and maintenance of cybersecurity policies, standards, and procedures - Participate in internal and external audits related to cybersecurity and risk management - Monitor regulatory changes and assess impact on organizational risk posture - Contribute to the organization's cybersecurity governance structure and risk committee activities - Executive Reporting & Metrics Prepare comprehensive cyber risk reports and presentations for executive leadership, board of directors, and key stakeholders - Develop and maintain cyber risk dashboards with Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs) - Communicate complex cybersecurity risks in business terms to non-technical executive audiences - Provide regular updates on risk trends, threat landscape, and mitigation progress - Present risk-based recommendations to support strategic business decisions - Strategic Partnership & Advisory Partner with engineering, IT, security, and product teams on new initiatives and technology implementations - Provide expert cybersecurity risk guidance during project planning and system design phases - Advise business units on cyber risk implications of strategic decisions and initiatives - Collaborate with cross-functional teams including legal, compliance, privacy, and internal audit - Emerging Technology & AI Governance Assess cybersecurity and privacy risks associated with AI/ML systems and emerging technologies - Support the development of AI governance frameworks and responsible AI practices - Evaluate risks related to AI implementation including data privacy, model security, and ethical considerations - Stay current with emerging technology risks and evolving regulatory requirements We need to ensure each bullet is a separate
  • . Some lines have multiple sentences combined; we keep as is. Now Requirements (Required Qualifications): Education & Experience: - Bachelor's degree in Cybersecurity, Information Security, Risk Management, Computer Science, Information Technology, or related field - 5-8 years of progressive experience in cybersecurity risk management, information security, or IT risk - Proven track record of conducting enterprise-level cyber risk assessments in complex technology environments - Experience with cloud security risk assessment and cloud platforms (AWS, Azure, GCP) - Demonstrated experience in third-party risk management and vendor security assessments Professional Certifications Required (at least one): - CRISC (Certified in Risk and Information Systems Control) - CISSP (Certified Information Systems Security Professional) - CISM (Certified Information Security Manager) Preferred: CISA (Certified Information Systems Auditor) CGRC (Certified in Governance, Risk and Compliance) CCSP (Certified Cloud Security Professional) Additional relevant cybersecurity or risk management certifications We'll treat these as list items under Requirements. Now Qualifications (Preferred Qualifications): - Master's degree in Cybersecurity, Information Security, Risk Management, or related field - Background in information security operations or security engineering - Knowledge of security architecture and secure design principles - Experience with security incident response and business continuity planning - Familiarity with AI/ML security risks and emerging technology governance - Understanding of privacy regulations (GDPR, CCPA, PIPEDA) Also there is "Key Competencies" list; maybe that could go under Skills? But we already have Skills heading. The Key Competencies list includes: - Strategic risk thinking and business acumen - Proactive risk identification and problem-solving - Executive presence and communication - Stakeholder influence and relationship building - Adaptability to evolving threat landscape - Ethical judgment and integrity - Continuous learning and professional development - Collaboration and cross-functional partnership We could put those under Skills as well, maybe separate from technical skills. Now Skills section: we have Cybersecurity & Technical Skills list and Professional Skills list. Cybersecurity & Technical Skills: - Deep understanding of cybersecurity principles, threats, vulnerabilities, and attack vectors - Strong knowledge of risk management frameworks (NIST, ISO 27001, Soc2, Sox) - Experience with vulnerability management tools and processes - Understanding of cloud security architecture and controls (AWS, Azure, GCP) - Knowledge of security controls, defense-in-depth strategies