The Cybersecurity Risk and Compliance Analyst ensures that the organization's technology ecosystem is evaluated correctly, assessed, and managed to ensure compliance and minimize cybersecurity risk exposure and impacts to the business. The analyst will assist with tracking open audit findings and facilitate response generation, information gathering, testing evidence, and escalation of the prior conclusions. The analyst will collaborate with infrastructure team members, drive the adoption of security best practices, assist with creating new policies, improve existing security processes, and support adherence to the organization's security policies and procedures.
BS or MA in computer science, information security, cybersecurity or a related field.
• 3+ years of experience in an IT audit, enterprise risk management (ERM) role or cyber risk management role
• 3+ years of experience with regulatory compliance, risk management frameworks, and information security management frameworks (e.g., ISO 27000, CMMC, NIST 800-171, NIST Risk Management Framework, CARF, etc.)
• Strong background in conducting Business Impact Analysis (BIA) to evaluate the potential impact of cybersecurity risk on critical business processes and functions.
• Experience understanding and articulating business goals and objectives.
• Experience identifying and assessing risks to the organization's business.
• Experience communicating complex technical concepts to non-technical audiences.
• Experience with cybersecurity principles and practices, including risk management, security controls, and incident response.
• Experience with cybersecurity technologies and systems, such as firewalls, intrusion detection systems, and security information and event management (SIEM) systems.
• Familiarity in one or more of the following areas: Identity management, PAM, SSO and MFA
• Ability to leverage research from various sources such as government research, think tanks, academic research, and industry reports
