Senior Security Risk Analyst

This is a fully remote position, open to applicants in Missouri.

📋 Description

• Take ownership of the lifecycle and documentation related to cybersecurity risks.

• Oversee the processes for risk intake, documentation, validation, monitoring, escalation, and reporting.

• Create and sustain standardized procedures for capturing risks arising from cybersecurity GRC workstreams.

• Design and maintain the structure of the cybersecurity risk register, incorporating taxonomy, categorization, scoring, lifecycle states, ownership, thresholds, workflows, and responsibilities.

• Manage the cybersecurity component of the enterprise risk register effectively.

• Collaborate with Enterprise Risk Management to ensure alignment between cybersecurity and enterprise risk management programs.

• Engage with cybersecurity risk owners to gain insights into risk causes, drivers, impacts, mitigation strategies, remediation plans, projects, and controls.

• Provide guidance to stakeholders on standards for risk documentation, ownership, status updates, and escalation protocols.

• Generate reports on individual risks and the overall cybersecurity risk profile.

• Identify and prioritize top, emerging, and persistent cybersecurity risks for executive decision-making.

• Work in conjunction with penetration testing, risk assessment, control monitoring, maturity assessment, and security issue management teams.

• Create and enhance dashboards, scorecards, and regular cybersecurity risk reporting.

• Collaborate with metrics, reporting, data, and analytics teams to enhance data quality, automation, consistency, and scalability.

• Participate in specialized GRC projects, including framework mapping, tooling enhancements, audit support, lifecycle improvements, metrics governance, and deep dives into risk.

• Develop and maintain cybersecurity risk management documentation, including policies, standards, procedures, templates, guidance materials, and roadmaps.

• Ensure that practices are in alignment with NIST CSF, ISO/IEC 27001, HIPAA Security Rule, HITRUST CSF, SOC 1/SOC 2, and ARC AMPE.

• Foster transparent, accountable, and risk-aware decision-making through timely and customer-focused risk insights.

• Perform additional duties as assigned.

• Adhere to all policies and standards.

⛳️ Requirements

• Must have authorization to work in the U.S. without requiring employment-based visa sponsorship now or in the future.

• Bachelor's degree in IT, MIS, Accounting, Finance, Business Administration, or a related field, or equivalent experience.

• A minimum of 4 years of combined experience in auditing and IT controls design.

• Familiarity with IT systems and processes.

• Experience in evaluating internal technical control systems.

• At least 4 years of experience in enterprise risk management, operational risk, cybersecurity governance, risk and compliance (GRC), audit, or related fields within a large or regulated enterprise environment.

• Proven hands-on experience in managing, administering, or significantly contributing to a formal cybersecurity or technology risk register.

• Strong understanding of risk assessment methodologies, risk taxonomies, inherent risk, residual risk, risk appetite, risk tolerance, and risk treatment strategies.

• Knowledge of the cybersecurity risk management lifecycle.

• Preferred experience in supporting GRC-related initiatives or projects beyond steady-state operations.

• Experience with Archer or comparable GRC platforms is strongly preferred.

• Ability to work collaboratively across functions and facilitate discussions with senior and executive-level stakeholders.

• Excellent written and verbal communication skills.

• Required certifications include CISSP, Security+, CISM, CISA, CGEIT, or CRISC.

🏝️ Benefits

• Health insurance coverage.

• 401K retirement plan.

• Stock purchase options.

• Tuition reimbursement for further education.

• Paid time off in addition to holidays.

• Flexible work arrangements, including remote, hybrid, field, or office schedules.

• Additional incentives may be included in total compensation.

• Equal opportunity employer committed to promoting diversity.