Job Summary

We are seeking a versatile Business Impact & Information Security Analyst to support enterprise risk management initiatives across business continuity, operational resilience, and information security. The role will assess organizational vulnerabilities, business impacts, security risks, critical dependencies, and recovery requirements while collaborating with business, IT, operations, and security stakeholders.

Key Responsibilities
• Lead structured interviews and workshops with stakeholders to identify critical business functions, security requirements, operational dependencies, and risk exposure.
• Map critical business functions, workflows, technical dependencies, and security control touchpoints across the organization.
• Document operational interdependencies, assess security control effectiveness, and identify potential single points of failure.
• Research and analyze emerging cybersecurity threats, vulnerabilities, and attack vectors and assess their potential business impact.
• Conduct business impact analyses and evaluate potential disruption scenarios involving system failures, supply chain outages, and security incidents.
• Assess financial, operational, legal, and reputational impacts associated with business disruptions and security events.
• Develop integrated risk matrices and impact classification frameworks covering business continuity and information security risks.
• Correlate security events and threat intelligence with business impact scenarios and contribute to threat modeling activities.
• Evaluate security controls and countermeasures using recognized frameworks such as NIST, ISO 27001, and CIS.
• Review system configurations against security baselines and hardening standards.
• Assess cloud security configurations and compliance across AWS, Azure, and GCP environments.
• Define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical applications and business functions, incorporating security restoration requirements.
• Establish recovery prioritization criteria that incorporate security validation requirements.
• Collaborate with IT, operations, and security teams to validate recovery targets, security controls, and remediation strategies.
• Assist with security and business continuity audits and provide evidence of control implementation.
• Maintain policies, procedures, runbooks, security controls, business impact profiles, and related documentation.
• Track and report security metrics, business continuity KPIs, and integrated risk indicators.
• Develop executive-ready dashboards, presentations, and reports based on analytical findings.
• Present continuity strategies, risk findings, and security recommendations to stakeholders and leadership.
• Maintain documentation in alignment with organizational and regulatory requirements.

Required Qualifications
• 3-5 years of combined experience in business continuity, risk management, and/or information security.
• Bachelor's degree in Business Administration, Information Technology, Cybersecurity, Risk Management, Data Science, or a related field, or equivalent professional experience.
• Experience conducting business impact analyses and risk assessments.
• Strong understanding of business continuity planning, operational resilience, and supply chain dependency analysis.
• Solid understanding of cybersecurity principles, frameworks, and best practices.
• Knowledge of common attack vectors, vulnerabilities, mitigation techniques, and security incident response procedures.
• Understanding of network protocols, system architecture, and security technologies.
• Experience with enterprise continuity platforms such as ServiceNow BCM or similar solutions.
• Experience with data collection frameworks and survey tools.
• Strong knowledge of relational databases, SQL, and advanced spreadsheet functions.
• Knowledge of firewall, IDS/IPS, network security, cloud security, and CSPM technologies.
• Strong analytical, critical thinking, problem-solving, and attention-to-detail skills.
• Excellent communication and stakeholder management skills, including the ability to facilitate workshops and explain technical concepts to non-technical audiences.

Preferred Qualifications
• Experience working in regulated industries such as finance, healthcare, or government.
• Experience with contractor or consulting engagements.
• Experience with security assessments, control validation, and cloud security reviews.
• Master's degree or additional relevant professional training.

Certifications
• Certified Business Continuity Professional (CBCP).
• CBCI, MBCI, or similar business continuity certification.
• Certified Information Systems Security Professional (CISSP).
• GIAC Security Essentials (GSEC).
• Certified Information Security Manager (CISM).
• AWS Security Specialty or Azure Security Engineer certification.