Cybersecurity Sr. Risk Analyst – ServiceNow

Cybersecurity Sr. Risk Analyst – ServiceNow (Vendor Risk Management)

Contract | 1 year (possible extension) | Onsite – Lake County, IL (Chicago area)

About the role

We're hiring a Cybersecurity Sr. Risk Analyst with strong ServiceNow and business analysis experience to support a Vendor Risk Management and Business Continuity program. You'll sit between cybersecurity, business stakeholders, and technical teams — gathering requirements, managing enhancements and defects, running UAT, and reporting status to leadership.

What you'll do

• Gather, analyze, and document business requirements for risk management processes and platform solutions
• Develop use cases, user stories, process maps, and functional requirements for cybersecurity and GRC initiatives
• Manage and prioritize enhancement requests; translate business needs into actionable development requirements
• Coordinate testing — test strategy, test scripts, UAT, defect tracking, and validation of delivered solutions
• Work the release cycle with cross-functional teams, developers, and data migration projects
• Support incidents and defects end to end: troubleshoot root cause and identify the correct path forward
• Present weekly status updates to leadership on upcoming enhancements, testing cycles, and in-flight stories
• Support audits, compliance, and regulatory requests with documentation and evidence

Required

• 10+ years in cybersecurity risk analysis or a closely related field
• ServiceNow experience — GRC, Vendor Risk (CVRM), Business Continuity (BCM), or TPRM modules preferred at an advanced level
• Certifications: Certified Scrum Master (CSM) and/or ServiceNow Administrator, Developer, or general user certified
• Bachelor's degree in Information Security, Computer Science, IT, or related field (or equivalent experience)
• Business analysis experience: requirements gathering, use case and test case development
• Strong understanding of cybersecurity risk management, third-party/vendor risk, and GRC frameworks

Preferred

• PMP, CRISC, CISA, CISM, or CISSP
• Audit experience
• Familiarity with ISO 27001, SOC 2, HITRUST, FedRAMP, ISO 22301
• Procurement and risk process exposure
• GRC toolset and information security / risk control framework knowledge

Details

• Schedule: 40 hours/week
• Travel: none
• Interview: one round, Teams video
• Start: ASAP (targeting early December)
• No far commutes — local candidates only

Apply with your updated resume and a short note on your ServiceNow and vendor risk experience.