| Location | Raleigh, NC (Remote) |
The Information Security Risk Analyst will conduct an annual third-party risk assessment of a technical implementation vendor using the North Carolina Statewide Information Security Manual as the assessment framework. Working alongside a lead analyst, this individual will take ownership of key assessment deliverables, including the System and Data Inventory, Risk Registry, and Risk Assessment Report (RAR).
Conduct annual third-party information security risk assessments of technical implementation vendors.
Apply the North Carolina Statewide Information Security Manual to evaluate vendor security practices, controls, and compliance.
Collaborate with a lead analyst throughout the assessment process.
Conduct vendor interviews to gather information and evaluate security practices.
Review and assess vendor-provided documentation and evidence to identify potential risks and control gaps.
Provide feedback to vendors regarding assessment findings and areas requiring improvement.
Develop and maintain the System and Data Inventory.
Own the creation and delivery of the Risk Registry and Risk Assessment Report (RAR).
Prioritize assessment findings and summarize risk status for project managers and executive leadership.
5 years of thorough knowledge of mainstream operating systems and security technologies, including network security appliances, identity and access management, and cryptography.
3 years of working knowledge of the IT security industry and federal/state regulations, with deep understanding of NIST SP 800-53, SP 800-30, and SP 800-37.
3 years of experience performing vendor interviews, evaluating evidence, and providing feedback to vendors.
3 years of experience prioritizing and summarizing risk assessment status for project managers and executive leadership.
Professional certifications such as CISSP or CISM.
Experience performing NIST SP 800-53-based risk assessments.
Experience with the NIST Cybersecurity Framework (CSF) and Privacy Framework.
Experience completing HITRUST risk assessments.
Bachelor's degree in Computer Science or a related IT field from an appropriately accredited institution and 2 years of progressive experience in IT Security or a closely related area; OR
Associate degree in Computer Science or a related IT field and 3 years of progressive experience; OR
An equivalent combination of education and experience.