Cybersecurity Business Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Lead comprehensive discovery initiatives across stakeholders in business, cybersecurity, technology, risk, legal, privacy, procurement, and operations.

• Clearly define the problem, value hypothesis, scope, expected outcomes, constraints, and measurable acceptance criteria.

• Gather, analyze, reconcile, and establish a baseline for business, functional, non-functional, security, privacy, regulatory, operational, and reporting requirements.

• Utilize interviews, workshops, observations, document analysis, process mapping, and data analysis techniques.

• Convert cyber risks, threat scenarios, control objectives, and technical constraints into comprehensible business language and deliverables.

• Create decision papers, epics, user stories, use cases, process and data models, traceability matrices, and testable requirements.

• Manage the quality and lifecycle of requirements, encompassing version control, prioritization, change management, impact assessments, and traceability.

• Monitor requirements from initial need through design, construction, testing, deployment, control evidence, and realization of benefits.

• Produce or coordinate program artifacts including demand inputs, business requirements, product descriptions, current and future state processes, stakeholder maps, RACI, data definitions, acceptance criteria, decision logs, and readiness assessments.

• Collaborate with security architects and subject matter experts across various cybersecurity domains.

• Plan and facilitate workshops, playback sessions, design reviews, and sign-off forums effectively.

• Identify assumptions, conflicts, gaps, and dependencies, driving them toward clear decision-making.

• Assist in sourcing and supplier engagement by defining outcome-based requirements, evaluation criteria, use cases, service levels, security obligations, evidence expectations, and RFP clarification responses.

⛳️ Requirements

• Demonstrated senior-level business analysis experience in complex cybersecurity, technology, risk, or compliance transformations.

• Proficiency in requirements elicitation, process analysis, traceability, workshop facilitation, testing, and operational readiness.

• Capability to translate cybersecurity, risk, and technical concepts into actionable business requirements and decisions.

• Familiarity with RFP requirements, suppliers, global stakeholders, and hybrid delivery models.

• Relevant degree or equivalent professional experience.

• Comprehensive understanding of NIST CSF, ISO 27001, CIS Controls, and ITIL frameworks.

• Knowledge of secure delivery practices.

• Experience or exposure to identity governance and administration, IAM, MFA, and SSO.

• Experience or exposure to privileged access management and Active Directory security.

• Experience or exposure to security operations, logging, SIEM, SOC integration, and incident readiness.

• Experience or exposure to vulnerability management, exposure assessment, and external attack-surface management.

• Experience or exposure to application, API, web, and cloud security practices.

• Experience or exposure to infrastructure, endpoint, network, PKI, and certificate management.

• Experience or exposure to data security, privacy, cryptography, and information protection.

• Experience or exposure to cyber resilience, backup, recovery, crisis readiness, and continuity strategies.

• Experience or exposure to OT/IoT and logistics-site security protocols.

• Experience or exposure to third-party, supply chain, M&A, and regulatory cyber risk management.

• Experience or exposure to security governance, control frameworks, audit, and compliance practices.

• Experience or exposure to operationalization, service management, and continuous control improvement.

• A recognized certification in the field is preferred.

🏝️ Benefits

• 100% remote work opportunity.

• Occasional business travel required.

• Full-time employment status.