Bachelor's degree in Cybersecurity, Information Security, Risk Management, Computer Science, or related field
5-8 years of experience in cybersecurity risk management or IT risk
Proven experience in enterprise-level cyber risk assessments
Familiarity with cloud security risk assessment and platforms (AWS, Azure, GCP)
Experience in third-party risk management and vendor security assessments
Professional certification such as CRISC, CISSP, or CISM required
Responsibilities
Lead enterprise-wide cyber risk assessments across all operations and systems
Identify and evaluate cybersecurity risks, including threats and vulnerabilities
Develop and maintain risk registers to document and prioritize cyber risks
Create risk treatment plans to mitigate organizational exposure
Assess security risks associated with cloud environments and hybrid infrastructure
Oversee vulnerability management and ensure timely remediation of critical vulnerabilities
Conduct cybersecurity risk assessments of third-party vendors and monitor compliance
Benefits
Welcoming culture with social events and colleague networks
Opportunity to volunteer with philanthropic organizations
Career development through training, mentoring, and internal job moves
Open vacation policy plus national holidays and remote work flexibility
Competitive benefits including 401k match and health insurance
Strong wellbeing support and mental health resources
Recognition programs for outstanding work
International collaboration opportunities with global teams
Full Job Description
Job Description
This role is based in our Newton, MA office.
We are seeking an experienced and strategic Senior Cyber Risk Analyst to join our team. This role requires deep expertise in enterprise cybersecurity risk management, with responsibility for identifying, assessing, and mitigating cyber risks across the organization. You will lead enterprise risk assessments, partner with engineering and security teams on strategic initiatives, and provide executive-level reporting on the organization's cyber risk posture. This position also includes emerging responsibilities in AI governance and technology risk as part of a comprehensive enterprise risk management approach.
Key Responsibilities
Enterprise Risk Assessment & Management
Lead comprehensive enterprise-wide cyber risk assessments across all business operations, systems, and infrastructure
Identify, analyze, and evaluate cybersecurity risks including threats, vulnerabilities, and potential business impacts
Develop and maintain enterprise risk registers, ensuring all cyber risks are properly documented, prioritized, and monitored
Create and implement risk treatment plans and mitigation strategies to reduce organizational exposure
Conduct risk assessments for new technologies, systems, and business initiatives in partnership with engineering and product teams
Utilize risk management frameworks (NIST CSF, ISO 27005, FAIR) to quantify and communicate risk
Cloud Security & Infrastructure Risk
Assess security risks associated with cloud environments (AWS, Azure, GCP) and hybrid infrastructure
Evaluate cloud architecture designs and configurations for security and compliance risks
Partner with cloud engineering teams to implement security controls and risk mitigation measures
Review and assess risks related to cloud migration projects and infrastructure changes
Vulnerability & Threat Management
Oversee vulnerability management program effectiveness and risk prioritization
Analyze vulnerability scan results and penetration test findings to assess enterprise risk exposure
Work with IT and security teams to ensure timely remediation of critical vulnerabilities
Monitor threat intelligence and assess potential impact to the organization
Evaluate the effectiveness of security controls in mitigating identified vulnerabilities
Third-Party & Vendor Risk Management
Conduct cybersecurity risk assessments of third-party vendors, suppliers, and business partners
Review vendor security questionnaires, certifications, and audit reports
Assess risks associated with vendor access to systems and data
Monitor ongoing third-party risk and ensure compliance with security requirements
Support vendor risk remediation efforts and contract security requirements
Governance, Compliance & Policy
Ensure compliance with relevant cybersecurity regulations, standards, and frameworks (SOC 2, ISO 27001, NIST, Sox, etc.)
Support the development and maintenance of cybersecurity policies, standards, and procedures
Participate in internal and external audits related to cybersecurity and risk management
Monitor regulatory changes and assess impact on organizational risk posture
Contribute to the organization's cybersecurity governance structure and risk committee activities
Executive Reporting & Metrics
Prepare comprehensive cyber risk reports and presentations for executive leadership, board of directors, and key stakeholders
Develop and maintain cyber risk dashboards with Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs)
Communicate complex cybersecurity risks in business terms to non-technical executive audiences
Provide regular updates on risk trends, threat landscape, and mitigation progress
Present risk-based recommendations to support strategic business decisions
Strategic Partnership & Advisory
Partner with engineering, IT, security, and product teams on new initiatives and technology implementations
Provide expert cybersecurity risk guidance during project planning and system design phases
Advise business units on cyber risk implications of strategic decisions and initiatives
Collaborate with cross-functional teams including legal, compliance, privacy, and internal audit
Emerging Technology & AI Governance
Assess cybersecurity and privacy risks associated with AI/ML systems and emerging technologies
Support the development of AI governance frameworks and responsible AI practices
Evaluate risks related to AI implementation including data privacy, model security, and ethical considerations
Stay current with emerging technology risks and evolving regulatory requirements
Required Qualifications
Education & Experience
Bachelor's degree in Cybersecurity, Information Security, Risk Management, Computer Science, Information Technology, or related field
5-8 years of progressive experience in cybersecurity risk management, information security, or IT risk
Proven track record of conducting enterprise-level cyber risk assessments in complex technology environments
Experience with cloud security risk assessment and cloud platforms (AWS, Azure, GCP)
Demonstrated experience in third-party risk management and vendor security assessments
Professional Certifications
Required (at least one):
CRISC (Certified in Risk and Information Systems Control)
CISSP (Certified Information Systems Security Professional)
CISM (Certified Information Security Manager)
Preferred:
CISA (Certified Information Systems Auditor)
CGRC (Certified in Governance, Risk and Compliance)
CCSP (Certified Cloud Security Professional)
Additional relevant cybersecurity or risk management certifications
Cybersecurity & Technical Skills
Deep understanding of cybersecurity principles, threats, vulnerabilities, and attack vectors
Strong knowledge of risk management frameworks (NIST, ISO 27001, Soc2, Sox)
Experience with vulnerability management tools and processes
Understanding of cloud security architecture and controls (AWS, Azure, GCP)
Knowledge of security controls, defense-in-depth strategies, and compensating controls
Familiarity with compliance frameworks (SOC 2, ISO 27001, NIST 800-53)
Experience with GRC (Governance, Risk, and Compliance) platforms
Understanding of network security, application security, and infrastructure security
Qualifications
Professional Skills
Exceptional analytical and critical thinking skills with strong attention to detail
Excellent written and verbal communication skills, particularly for executive audiences
Ability to translate technical cybersecurity concepts into business risk language
Strong stakeholder management and influence skills across all organizational levels
Proficiency in data analysis and visualization tools
Project management capabilities and ability to manage multiple priorities
Preferred Qualifications
Master's degree in Cybersecurity, Information Security, Risk Management, or related field
Background in information security operations or security engineering
Knowledge of security architecture and secure design principles
Experience with security incident response and business continuity planning
Familiarity with AI/ML security risks and emerging technology governance
Understanding of privacy regulations (GDPR, CCPA, PIPEDA)
Key Competencies
Strategic risk thinking and business acumen
Proactive risk identification and problem-solving
Executive presence and communication
Stakeholder influence and relationship building
Adaptability to evolving threat landscape
Ethical judgment and integrity
Continuous learning and professional development
Collaboration and cross-functional partnership
We believe that great things happen when people connect face-to-face. That's why we work in-person with each other, or with customers and partners, three days a week or more. When you're not spending time together in one of our offices or other workplaces - like at an Informa event - you get the flexibility and support to work from home or remotely.
Our benefits include:
Great community: a welcoming culture with in-person and online social events, our fantastic Walk the World charity day and active colleague groups and networks promoting a positive, supportive, and collaborative work environment
Broader impact: take up to four days per year to volunteer with a philanthropic organization
Career opportunity: the opportunity to develop your career with bespoke training and learning, mentoring platforms and on-demand access to thousands of courses on LinkedIn Learning. When it's time for the next step, we encourage and support internal job moves
Time out: Open Vacation, plus 10 national holidays, and the chance to work from (almost!) anywhere for up to four weeks a year
Competitive benefits, including a 401k match, health, vision and dental insurance, parental leave and an ESPP offering company shares at a minimum 15% discount
Strong wellbeing support through EAP assistance, mental health first aiders, free access to a wellness app and more
Recognition for great work, with global awards and kudos programs
As an international company, the chance to collaborate with teams around the world
The salary range for this role is $150K-$170K/YR, based on experience.
This posting will automatically expire on Nov 18, 2026.
About Informa
Informa is a publishing and events company that provides information and services to businesses and professionals. The company's products include books, journals, and online databases. Informa also organizes conferences and exhibitions in various industries, including healthcare, finance, and technology. The company was founded in 1998 and is headquartered in London, England. Informa has offices in more than 30 countries.
