Cyber Risk Management Analyst

Company

• Our client is a leading global hospitality organization with a large international portfolio and a long-standing reputation for innovation and guest service. The organization has also received significant recognition for its workplace culture, including being named a No. 1 World’s Best Workplace by Great Place to Work and Fortune.

Job Title

• Cyber Risk Management Analyst

Location

• Fully remote within the U.S.; DMV-area candidates preferred but not required. Working hours should substantially overlap with approximately 9:00 AM–5:00 PM Eastern. Very infrequent travel or office attendance may be required.

Role Type

• Contract; initial engagement of up to 2 years with potential for extension.

Must Have Skills:

• Approximately 5–7 years of cybersecurity experience with a strong foundation in cyber risk/GRC, including TPRM, cyber assessments, and/or risk governance.
• Hands-on experience reviewing policies, standards, ISO-related materials, third-party attestation reports, and other security documentation to assess and score risk using established methodologies.
• Commercial/private-sector cybersecurity risk experience and a practical understanding of risk management, including balancing remediation with business needs and risk acceptance.
• Strong cross-functional communication skills with the ability to collaborate across business, IT, and cybersecurity teams while producing detail-oriented reporting suitable for executive audiences.
• Self-directed and process-oriented with broad cybersecurity knowledge, strong research skills, and the ability to quickly understand unfamiliar technologies and solutions.

Responsibilities and Job Details:

• Perform business-impact assessments and final risk scoring based on findings identified through cybersecurity reviews.
• Track identified risks and issues within GRC processes and ensure risk-register information remains accurate and current.
• Review and assess security documentation, including policies, standards, third-party attestations, and ISO-related materials.
• Support third-party risk management activities and provide coverage across the TPRM process as needed.
• Conduct bespoke and ad hoc risk analyses across technologies, solutions, and business initiatives.
• Partner with business, IT, cybersecurity, and other stakeholders to understand identified issues and determine their business-risk implications.
• Maintain high-quality, accurate risk reports and ensure deliverables are aligned for audiences that may include executive leadership.
• Manage follow-up activities for identified risks and issues through established governance processes.
• Independently research unfamiliar technologies and solutions to develop sufficient context for effective risk assessments.
• Manage multiple competing priorities while operating effectively in a process-driven, highly autonomous environment.
• Work as part of a small cyber risk team where initiative, accountability, adaptability, and the ability to work independently are essential.
• Target start date is December 1 to support transition and knowledge transfer with the outgoing contractor.