As a Security Analyst, you will be a key member of the Operational Risk Management team that identifies, tracks, monitors and advises on security risks both operationally and for third-party vendors. The team is responsible for implementation of proactive security risk management programs, and you will have a range of tools for delivery and automation at your disposal. You will engage with groups across Security, Engineering, Technology, and Commercial to identify, assess, measure, and treat security risk. You will also participate in annual and ad-hoc assessments, perform continuous monitoring of remediation plans, and be expected to make recommendations for process improvement. As part of this role, you will have the opportunity to develop key metrics for monitoring third parties (vendors) and communicating risk, and you will present these to management stakeholders.
Key Responsibilities
Perform third-party (vendor) risk, business impact, and security risk assessments
Identify, review, assess, and recommend treatment options for operational and third-party risks
Gather, analyze, and report on operational risk assessment metrics
Communicate risk to business stakeholders
Develop risk treatment plans with risk owners to mitigate operational risks and test treatment plans for closure
Contribute to departmental and company-wide documentation for risk management processes
Deliver and manage annual and new hire Security Awareness campaigns
Deliver and manage periodic internal Phishing Awareness campaigns
Gather and report on Security Awareness metrics
Identify areas for process improvement or automation
Provide mentorship or guidance to junior team members
Required Experience/Skills
3+ years of experience of security governance and/or cyber risk management
Excellent written and communication skills
Strong critical thinking and problem-solving abilities
Comfort with cloud/SaaS environments (AWS) and associated technical risk assessments
Ability to operate with a high degree of independence
Familiarity with NIST Cyber Security Framework, SOC 2, and ISO 27001.
Preferred Experience/Skills
Working knowledge of secure software development lifecycles, AWS (Amazon Web Services), infrastructure security, and/or security audit
Understanding of security control frameworks such as SOC 2, NIST (National Institute of Standards and Technology), or ISO
BS/BA in Computer Science, Information Technology, or a related field; professional certification (e.g., CompTIA Security+, CISSP) is a plus
AWS Certified Cloud Practitioner or equivalent is a plus