Cybersecurity Risk Analyst III

Location: Pittsburgh, PA

Work Arrangement: Hybrid – 4 days onsite per week

Job Summary We are seeking a Cybersecurity Risk Analyst III to assess cybersecurity risks, identify control gaps, and drive effective remediation across the organization. This role partners with cybersecurity control owners to evaluate risk exposure, challenge mitigation strategies, monitor issue resolution, and communicate findings to senior management. The ideal candidate combines strong analytical skills with cybersecurity GRC experience, data analysis, and stakeholder management.

Key Responsibilities

• Analyze cybersecurity risks, control gaps, and findings to develop actionable recommendations and mitigation strategies.
• Challenge control owners on remediation plans, evaluate compensating controls, and assess residual risk.
• Track cybersecurity issues, risks, and remediation activities through ServiceNow.
• Analyze data and reporting dashboards to identify trends, operational roadblocks, and opportunities to improve control effectiveness.
• Communicate risk assessments, findings, and recommendations to stakeholders and senior management.
• Collaborate with Information Security, IT, and business teams to support continuous cyber hygiene and control effectiveness.
• Ensure risk management activities align with applicable cybersecurity standards and frameworks.

Required Qualifications

• 7+ years of professional experience, including a background in cybersecurity or related technology.
• Experience with information security Governance, Risk, and Compliance (GRC).
• Strong analytical, investigative, and troubleshooting skills.
• Experience with data analysis and reporting tools, such as SQL, DB2, Power BI, Business Objects, Qlik, Tableau, or Excel.
• Proficiency with Microsoft Office and familiarity with ServiceNow.
• Excellent written and verbal communication, stakeholder management, and problem-solving skills.
• Ability to independently assess risk, challenge assumptions, and drive issues toward resolution.

Preferred Qualifications

• Experience in financial services or the securities industry.
• Knowledge of cybersecurity frameworks, including NIST CSF, NIST SP 800-53, CRI, or ISO.
• General understanding of Identity and Access Management (IAM) principles.
• Experience supporting regulatory examinations or internal audits.
• CISSP, CISM, or CGRC certification.
• Project management experience or familiarity with the Software Development Life Cycle (SDLC).

Additional Details

• Standard business hours, generally 9:00 AM–5:00 PM.
• Occasional schedule flexibility may be needed during regulatory examinations.