Information Security Risk Analyst
Position Overview
The Information Security Risk Analyst is responsible for conducting annual Third-Party Risk Assessments (TPRAs) of technology vendors that support critical business systems and services. This role partners closely with senior security and risk professionals throughout the assessment lifecycle and is responsible for producing key deliverables, including System and Data Inventories, Risk Registers, and Risk Assessment Reports (RARs).
The ideal candidate will have experience evaluating vendor security controls, identifying and documenting risks, and providing actionable recommendations to strengthen organizational security and compliance programs.
Key Responsibilities
- Conduct third-party security risk assessments of technology vendors and service providers.
- Evaluate vendor security controls against industry-recognized security frameworks, organizational policies, and applicable regulatory requirements.
- Perform vendor interviews, collect and review supporting evidence, and assess the effectiveness of security controls.
- Develop and maintain comprehensive system and data inventories.
- Identify, analyze, document, and prioritize information security risks.
- Create and maintain risk registers, including risk ratings, mitigation recommendations, and remediation tracking.
- Prepare formal Risk Assessment Reports (RARs) and present findings to project teams and leadership.
- Collaborate with internal stakeholders and vendors to validate assessment findings and remediation plans.
- Monitor assessment progress and communicate status, risks, and recommendations to project managers and executive leadership.
- Support the continuous improvement of third-party risk management processes, methodologies, and governance practices.
Required Knowledge, Skills, and Abilities
- Strong understanding of information security principles, risk management methodologies, and security governance practices.
- Thorough knowledge of operating systems, network security technologies, security monitoring tools, identity and access management (IAM), and cryptographic controls.
- Working knowledge of cybersecurity regulations, industry standards, and compliance frameworks.
- Strong understanding of NIST publications and frameworks, including:
- NIST SP 800-53 (Security and Privacy Controls)
- NIST SP 800-30 (Guide for Conducting Risk Assessments)
- NIST SP 800-37 (Risk Management Framework)
- Ability to conduct vendor interviews, review supporting documentation, and evaluate the adequacy of security controls.
- Strong analytical, documentation, and report-writing skills.
- Ability to communicate complex technical risks clearly to both technical and non-technical audiences.
- Excellent organizational skills with the ability to manage multiple priorities and deadlines.
Minimum Education and Experience
One of the following:
- Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field, plus two (2) years of progressive experience in Information Security or a related discipline; OR
- Associate degree in Computer Science, Cybersecurity, Information Technology, or a related field, plus three (3) years of progressive experience in Information Security or a related discipline; OR
- An equivalent combination of education, training, and relevant professional experience.
Required Qualifications
- Professional cybersecurity certification such as:
- CISSP (Certified Information Systems Security Professional)
- CISM (Certified Information Security Manager)
- Equivalent industry-recognized certification may be considered.
- Experience conducting risk assessments based on NIST SP 800-53.
- Experience applying the NIST Cybersecurity Framework (CSF).
- Experience working with security and privacy control frameworks.
- Experience assessing third-party vendors and documenting security risks.
- Experience creating Risk Assessment Reports, Risk Registers, and remediation recommendations.
Preferred Qualifications
- Experience performing HITRUST assessments or working in HITRUST-certified environments.
- Experience supporting Third-Party Risk Management (TPRM) programs.
- Experience using Governance, Risk, and Compliance (GRC) platforms.
- Experience working within highly regulated industries such as healthcare, financial services, insurance, or government.
- Experience presenting risk findings and remediation recommendations to senior leadership and executive stakeholders.
Desired Attributes
- Strong investigative, analytical, and critical-thinking skills.
- Ability to balance business objectives with security and compliance requirements.
- Excellent verbal and written communication skills.
- Detail-oriented with a strong focus on accuracy, documentation, and follow-through.
- Ability to work independently while collaborating effectively with cross-functional teams and external vendors.
- Strong stakeholder management and relationship-building skills.