Sr. Security Risk Management Analyst

Company and team

Role overview

Responsibilities

• Execute security risk assessments from scoping and data gathering through analysis, findings documentation, and stakeholder communication.
• Refine assessment templates, workflows, and process guides for consistent, scalable execution.
• Maintain risk registers and track risks through mitigation, remediation, or acceptance.
• Build and maintain KRI tracking and leadership risk reports, translating raw data into clear deliverables.
• Partner with Vulnerability Management, Application Security, and Blue Team to gather data and incorporate operational findings.
• Identify opportunities to streamline and automate risk processes and recommend them to program leadership.
• Maintain risk program standards, procedures, and guidance materials.
• Collaborate with Compliance, Internal Audit, Engineering, and Legal to contextualize and action findings.
• Support audit preparedness and risk reporting as directed by program leadership.

Required qualifications

• 5+ years of information security risk management, cybersecurity governance, or GRC experience.
• Hands-on experience conducting risk assessments and owning findings documentation.
• Strong working knowledge of risk frameworks such as NIST CSF, ISO 27005, PCI DSS, or DoCRA.
• Experience building repeatable, structured, and scalable processes from ad hoc workflows.
• Strong risk data analysis and experience with KRI tracking and internal stakeholder reporting.
• Familiarity with GRC tools such as AuditBoard, Archer, OneTrust, or ServiceNow GRC.
• Proficiency in Google Workspace and excellent written communication.
• Self-directed, comfortable with ambiguity, and able to execute with appropriate direction.
• Bachelor's degree or higher in IT, Cybersecurity, Business Administration, Engineering, or a related field.

Additional skills and credentials

• SQL and/or Tableau experience is a strong plus.
• CISM, CRISC, or ISO 27001 credentials are a plus.
• Fintech or regulated-industry experience is preferred.

Application information

• Applications are accepted on an ongoing basis unless the posting states a specific deadline.
• Candidates may be asked to complete job-related skills or work-style assessments as part of the hiring process.