Risk Analyst – Cybersecurity

Role Summary

This senior third-party cyber risk assessment role is responsible for evaluating supplier security controls throughout the pre-contract due diligence and ongoing monitoring lifecycle. The position conducts on-site and virtual assessments, reviews security evidence, and validates remediation of identified control gaps. The role also provides peer review of other assessors’ work and applies recognized cybersecurity and risk management frameworks to support supplier oversight. Experience in financial services, regulated industries, consulting, or managed security environments is highly valued.

Responsibilities

• Review supplier cybersecurity controls, policies, and supporting evidence.
• Conduct on-site and virtual third-party security risk assessments.
• Evaluate SOC 2, ISO 27001, penetration testing, SIG, and CAIQ documentation.
• Perform pre-contract cybersecurity due diligence and ongoing supplier monitoring.
• Peer review assessment work completed by other assessors.
• Validate that suppliers have remediated identified security and compliance gaps.
• Apply NIST and ISO cybersecurity and risk management frameworks.
• Document assessment findings, remediation requirements, and validation results.
• Support third-party risk management activities in regulated enterprise environments.
• Travel as needed to conduct on-site supplier assessments.

Qualifications

• 6+ years of experience in third-party cyber risk assessment, vendor risk management, or supplier security assurance.
• Experience conducting pre-contract due diligence and ongoing third-party monitoring.
• Demonstrated ability to review SOC 2, ISO 27001, penetration testing evidence, SIG questionnaires, and CAIQ assessments.
• Experience performing both on-site and virtual cybersecurity assessments.
• Peer review and remediation validation experience.
• Working knowledge of NIST and ISO cybersecurity frameworks.
• Experience within a large financial services or other regulated enterprise, such as a bank, insurer, card issuer, or asset manager, is strongly preferred.
• Consulting experience with a Big Four firm or managed security provider is valued, particularly when embedded with an enterprise team.
• Experience with OneTrust, ProcessUnity, Archer, Prevalent, Whistic, or ServiceNow IRM is preferred.
• CTPRP, CISA, CISSP, CISM, or CRISC certification is preferred, along with relevant education, training, certifications, or equivalent practical experience.

Publishing Pay Range: $68.00 – $73.00 Hourly

This is a fully remote role and can be performed from an approved location.