Sr. Security Risk Management Analyst

Execute security risk assessments end-to-end — scoping, data gathering, analysis, findings documentation, and communicating results to stakeholders — in alignment with program methodology set by leadership

Support the development and continuous refinement of risk assessment templates, workflows, and process guides that make the program consistent and scalable

Maintain risk registers and ensure identified risks are tracked accurately and progressing through mitigation, remediation, or acceptance workflows

Assist in building and maintaining Key Risk Indicators (KRI) tracking and risk reporting outputs, translating raw data into clear, well-structured deliverables for senior leadership review

Partner with technical teams including Vulnerability Management, Application Security, and Blue Team to gather risk-relevant data and incorporate operational findings into assessment work

Identify opportunities to streamline and automate risk processes and bring those recommendations to program leadership for prioritization

Contribute to the documentation and upkeep of risk program standards, procedures, and guidance materials

Collaborate with cross-functional teams including Compliance, Internal Audit, Engineering, and Legal to ensure risk findings are well-contextualized and properly actioned

Support audit preparedness activities and risk-related reporting as directed by program leadership

5+ years of experience in information security risk management, cybersecurity governance, or GRC

Hands-on experience conducting risk assessments and owning findings documentation — not just supporting assessments, but running them

Strong working knowledge of risk management frameworks such as NIST CSF, ISO 27005, PCI DSS, or DoCRA

Demonstrated ability to build repeatable processes, taking something ad hoc and making it structured and scalable

Strong data analysis skills, with the ability to clean, interpret, and present risk data clearly and accurately

Experience contributing to KRI tracking and risk reporting for internal stakeholder audiences

Familiarity with GRC tools such as AuditBoard, Archer, OneTrust, or ServiceNow GRC

Proficiency in Google Workspace

Excellent written communication, producing deliverables that are clear, well-organized, and don't require heavy editing

Self-directed and comfortable operating in ambiguity, able to take direction and run with it

Bachelor's degree or above in IT, Cybersecurity, Business Administration, Engineering, or a related field