Cybersecurity Risk Analyst I/II

Join the First Hawaiian Bank ‘ohana, where our culture flourishes with purpose. We prioritize the 3 C’s – Caring, Character and Collaboration – ensuring a workplace that is not only rewarding, but deeply fulfilling. Consistently recognized as one of the 'Best Places to Work in Hawaii' for 13 consecutive years, we take pride in our longstanding commitment to both our team and the communities we serve, spanning over 165 years.

Step into a career that offers stability, excitement, and growth. Experience the thrill of a dynamic environment paired with a comprehensive training program. Plus, enjoy the perks of our competitive compensation and benefits package. If you are ready for a career that empowers you to thrive, your journey starts here.

The Cybersecurity Risk Analyst is responsible for building relationships across the Bank with technical leads and business partners, and understanding technology stacks, designs, and review processes in support of the Bank’s cyber risk management practices. The role will participate in the development, implementation, and execution of a measurements-based cyber risk management program.

Essential Position Accountabilities: 

1. Reviews and assesses new and existing vendor engagements. Collaborates with technical leads and business partners to ensure comprehensive vendor portfolio management.  
2. Helps plan and implement process improvements to the cybersecurity risk management program. 
3. Develops and maintains documentation and metrics. Compiles program metrics required to assess the third-party cybersecurity risk management program and the Bank’s cyber risk posture to support risk reduction and produce executive reports with pertinent trending/forecasting metrics. 
4. Assists management in configuring, enhancing, and maintaining cybersecurity risk management tools and systems. 
5. Assists management with developing and implementing processes to support cyber risk identification, assessment, and impact analysis capabilities for the Bank. Conducts loss simulations and collaborates with technical leads and business partners on risk mitigation strategies.
6. Assists management with the development and maintenance of a registry of cyber risks and associated loss events through cyber scenario planning with business units. 
   

Compensation:

The annual salary range for this role is: $61,200 - $86,100 per year; commensurate with experience.

The ideal candidate will have:

• Bachelor’s degree in computer science, management information systems (MIS), engineering, statistics or related field, or equivalent work experience required
• Certified Information Systems Security Professional (CISSP), ISACA Certified in Risk and Information Systems Control (CRISC), or comparable security certification desired
• Working knowledge of requirements for Federal Financial Institutions Examination Council (FFIEC) IT examination, Gramm-Leach-Bliley Act (GLBA) Information Security Standards and Sarbanes-Oxley Section 404 (“Management Assessment of Internal Controls”)
• One or more years of experience in information security required (level I)
  
• Two or more years of experience in information security required (level II) 
• Cyber risk management experience
• Experience designing, implementing and managing risk management processes and workflows
• Develop and implement security plans and projects
• Knowledgeable in risk quantification modeling and platforms (e.g., strong understanding of basic probability, calibrated estimations, monte carlo simulations, etc.)
• Performs cybersecurity risk assessments and ongoing monitoring. (level II)
• Coordinates with managers and staff of IT, business units, and executive management. (level II)
  
• Able to plan, organize and budget
  
• Good written and verbal communication with demonstrable experience collaborating with technically oriented as well as business audiences
• Strong critical thinking and analytical skil