Cybersecurity Risk and Compliance Analyst (524)

Summary:

The Cybersecurity Risk and Compliance Analyst ensures that the organization's technology ecosystem is evaluated correctly, assessed, and managed to ensure compliance and minimize cybersecurity risk exposure and impacts to the business. The analyst will assist with tracking open audit findings and facilitate response generation, information gathering, testing evidence, and escalation of the prior conclusions. The analyst will collaborate with infrastructure team members, drive the adoption of security best practices, assist with creating new policies, improve existing security processes, and support adherence to the organization's security policies and procedures.

Essential Duties and Responsibilities:

• Assures successful implementation and functionality of security requirements and appropriate IT policies and procedures consistent with the organization's mission and goals.
• Monitors and audits compliance of cybersecurity policies to identify gaps
• Designs, implements, and maintains cybersecurity policies and procedures such as data access controls, acceptable use of technology, password management, and incident reporting procedures.
• Oversees security activities such as access control, incident management, response, forensics, and reporting.
• Build communication and escalation plans around the enterprise's third-party cybersecurity risk management activities.
• Works with regulatory officers and auditors as necessary
• Coordinates gathering third-party cybersecurity risk assessment data and prepares cybersecurity risk assessments for critical-related third parties as needed, to be published and communicated to stakeholders.
• Tracks identified cybersecurity risks and risk events.
• Maintains a current understanding of industry trends, emerging cyber threats, and new solutions that may impact the environment.
• Performs security reviews and identifies security gaps in security architecture, resulting in recommendations for inclusion in the risk mitigation strategy.
• Works with stakeholders to communicate business risk and mediation by agreed protection levels.
• Plans and conducts security authorization reviews and assurance case development for installing systems and networks.
• Performs IT and IS control reviews, including, but not limited to, operating procedures, system security, programming controls, backup and disaster recovery, and system maintenance.
• Follows up on audit findings to ensure management has taken corrective action(s).
• Translate security-related matters into business terms that are clear and understandable to executives.
• Identifies and evaluates complex business and technology risks, internal controls that mitigate risks, and related opportunities for internal control improvement.
• Other duties as assigned.

Education and Experience:

• BS or MA in computer science, information security, cybersecurity, or