Security Risk Analyst

Job Description 

External Posting Role Title – Security Risk Analyst 

College Board – Risk Management 

Location:  

This is a remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office). All CB employees are required to occasionally travel to meet in person for business purposes. 

Role Type:  

This is a full-time position 

About the Team  

The Information Security Governance Risk and Compliance (ISGRC) team at the College Board works closely with other teams across the organization to assess and certify the security of College Board’s information systems and processes. This dedicated team facilitates information security governance and compliance by assessing College Board’s vendors, reviewing and negotiating contractual commitments to information security, planning for disaster response and recovery, testing system strength using industry-recognized frameworks (ISO 27001, PCI-DSS and SOC2) and obtaining related compliance certifications, implementing information security policies, promoting security awareness and training, and testing the acumen of College Board employees through robust and innovative training and phishing campaigns.     

About the Opportunity   

As a Security Risk Analyst, you will have the critical role of being responsible for evaluating and managing exceptions to IT security policies, for managing the Organization’s Risk and Control Issues Register (Risk Register), and for developing reports and metrics.    

Your strong technical communication and negotiation skills will help you build relationships and collaborate with diverse stakeholders and reduce risk to the organization and ensure compliance.   

Under the direction of management, you will manage the Risk Register and perform security policy exceptions to help the College Board understand its critical risks.  

In this role you will:  

Manage the Risk Register (20%)  

• Leads the management of the issues and risks and quickly escalates any untimely completion of audit actions.   

• Works independently to communicate risks and works with others to problem-solve risks to tolerance levels based on data and evidence.    

• Maintains data quality of Risk Register and executes any required data clean-up exercises.  

• Understands College Board work to be able to drive Risk or Control Owners to ensure consistent application of policies and standards.  

• Raises awareness about Risk & Control Issues, Policy exceptions, and available risk reduction options.  

• Fosters a culture of risk awareness and compliance within the technology department and across the organization.   

Manage Policy Exceptions (65%)  

• Independently analyzes policy exception submissions and provides risk assessment reports for critical service lines, applications, and infrastructure hosted on-prem and in the cloud.   

• Evaluates and manage exceptions to IT security policies.  

• Manages materials for the Exception Review Board and presents exception information to executive leader