Cybersecurity Risk Analyst

Location: Denver, CO

Compensation: $50.00-52.00 hourly

Summary

The Cybersecurity Risk Analyst supports the organization by identifying, assessing, and managing cybersecurity risks associated with complex business operations, ensuring they remain within acceptable tolerances. The role conducts cybersecurity risk assessments, provides direction and guidance to stakeholders on addressing security risks and assessment findings, and supports the development of effective risk mitigation strategies. Success in this role requires strong business insight, decisiveness, tact, courage, relationship management skills, technical acuity, sound professional judgment, and the ability to communicate effectively with audiences at all levels, both within and outside the organization.

Responsibilities

• Perform assessments of external party information security controls to ensure they meet or exceed the client’s information security risk management requirements for the services to be provided.
• Collaborate with information technology and other business unit personnel to identify cybersecurity risks associated with current and planned projects.
• Determine information security risk profiles for various vendor and business partner services using questionnaires, relevant industry best practices and standards, and knowledge of the client policies.
• Recommend solutions to eliminate, reduce, or mitigate cybersecurity risk, and communicate said solutions to external parties and/or internal business stakeholders as appropriate.
• Provide direction and guidance as needed to internal project stakeholders concerning statutory, regulatory, and the client policy and program requirements.
• Record pertinent documentation and communications for all assessments in the client’s online information technology risk management platform.
• Report status of engagements to Global Cyber and Information Security management, project managers, and other business stakeholders as appropriate.
• Assist in enforcing information security policies, standards and procedures. Review requests for exceptions to security policies and provide recommendations to management.
• Research and advocate new technologies, architectures, and products that will support security requirements for the enterprise and its customers, business partners, and vendors.
• Perform other cybersecurity risk management tasks as assigned.

Educational/ Position Requirements

• 3+ years of cybersecurity risk management, IT security control design, and/or IT security control design audit experience.
• Bachelor’s degree in information systems, computer science, or related field preferred.
• Certified Information Systems Security Professional (CISSP), Certified Information Systems Manager (CISM), Certified Information Systems Auditor (CISA), or Certified in Risk and Information Systems Control (CRISC) credentials preferred. Global Information Assurance Certification Security Essentials (GSEC), CompTIA Security+, or similar credentials considered.
• Basic knowledge of industry frameworks, regulations, legislation, and audit methodologies, including SOC 1, SOC 2, ISO 27000, SIG, CAIQ, NIST Cybersecurity Framework, Sarbanes-Oxley (SOX), PCI-DSS, GDPR, and various federal and state privacy laws.
• Ability to broker complex discussions to achieve the proper balance between business needs and cybersecurity best practices.
• Ability to influence others through persuasion to arrive at desired outcomes.
• Ability to communicate effectively with a broad range of people and roles, including vendors, information technology professionals, and other business personnel.
• Ability and desire to seize the initiative, work proactively, and perform assigned duties in a highly independent manner.

Category Code: JN008

Seniority Level: Mid-Senior Level