Principal IT Risk Management Analyst

Role Overview

• Lead and evolve the IT security risk management program in alignment with organizational goals, risk appetite, and risk tolerance
• Partner with executive leadership to shape risk strategy and drive enterprise-wide adoption
• Serve as a key advisor on risk posture, translating technical findings into strategic business decisions
• Identify, assess, and quantify technology risks by evaluating cybersecurity threats, operational vulnerabilities, and emerging technology risks using qualitative and quantitative methodologies
• Conduct risk assessments using established frameworks, including NIST CSF and CIS Controls v8
• Translate technical findings into clear, actionable business risk and support risk-based decision making
• Manage and maintain the enterprise IT risk register, including risk ownership, scoring, and lifecycle tracking
• Design and implement IT security risk mitigation strategies and controls aligned with industry standards
• Lead the risk exception management process, including evaluation, documentation, and risk acceptance decisions
• Provide risk-informed guidance for complex technology initiatives, including emerging areas such as artificial intelligence and machine learning
• Integrate IT security risk management practices into business and technology processes
• Support the development and lifecycle management of information security policies and standards
• Define and evolve risk metrics, key risk indicators (KRIs), and risk appetite thresholds
• Develop dashboards and reporting that translate risk data into actionable insights for executive and board-level audiences
• Communicate complex risk concepts clearly to both technical and non-technical stakeholders
• Drive adoption of IT security risk platforms and workflow automation to improve efficiency and scalability
• Identify and implement automation opportunities across risk management workflows
• Continuously enhance risk methodologies, tools, and processes
• Stay current on the evolving threat landscape, emerging technologies, and industry practices
• Mentor and guide junior team members in direct or matrixed reporting relationships
• Lead or own workstreams while providing direction and support to junior analysts

Requirements

• 5+ years of IT risk management experience, with a focus on risk assessment, quantification, and risk register ownership (not primarily compliance or audit)
• 3+ years mentoring or leading team members
• Demonstrated experience mentoring analysts while owning and delivering discrete risk workstreams or program components
• Experience conducting risk assessments aligned to NIST CSF, CIS Controls v8, or similar frameworks
• Experience managing an IT risk register, risk exception processes, and residual risk documentation
• Experience developing risk metrics, dashboards, and executive reporting
• Experience with GRC platforms and workflow automation in a risk context
• Experience managing risks related to emerging technologies, including artificial intelligence
• Strong leadership, analytical, and problem-solving skills with a risk-first mindset
• Demonstrated team leadership through mentoring, coaching, or leading analysts
• Strong technical depth to identify risks, evaluate control effectiveness, and translate vulnerability and technical data into business risk
• Deep knowledge of NIST CSF, CIS Controls v8, and related frameworks
• Proven ability to build and manage an enterprise IT risk register and exception management program
• Experience building and evolving risk metrics, KRIs, dashboards, and executive reporting
• Hands-on experience with GRC platforms and workflow automation tools (e.g., Archer, ServiceNow GRC, OneTrust, Jira, Rapid7 Nexpose) and the ability to automate processes
• Understanding of AI/ML risk domains, including model risk, data integrity, bias, and adversarial threats, with the ability to recommend controls
• Experience drafting, reviewing, and improving information security policies and standards
• Ability to communicate technical concepts and residual risk clearly to non-technical stakeholders.

Tech Stack

• Cyber Security
• ServiceNow

Benefits

• medical, dental, vision, life and disability plans
• well-being incentives
• parental leave
• paid time off
• certain paid holidays
• tax saving accounts (FSA, HSA)
• 401(k) retirement benefit
• Employee Stock Purchase Plan
• tuition assistance
• entertainment and retail discounts
• overtime pay for non-exempt employees