Sr Risk Analyst

This role is based in our Newton, MA office.

We are seeking an experienced and strategic Senior Cyber Risk Analyst to join our team. This role requires deep expertise in enterprise cybersecurity risk management, with responsibility for identifying, assessing, and mitigating cyber risks across the organization. You will lead enterprise risk assessments, partner with engineering and security teams on strategic initiatives, and provide executive-level reporting on the organization's cyber risk posture. This position also includes emerging responsibilities in AI governance and technology risk as part of a comprehensive enterprise risk management approach.

Key Responsibilities

Enterprise Risk Assessment & Management

• Lead comprehensive enterprise-wide cyber risk assessments across all business operations, systems, and infrastructure
• Identify, analyze, and evaluate cybersecurity risks including threats, vulnerabilities, and potential business impacts
• Develop and maintain enterprise risk registers, ensuring all cyber risks are properly documented, prioritized, and monitored
• Create and implement risk treatment plans and mitigation strategies to reduce organizational exposure
• Conduct risk assessments for new technologies, systems, and business initiatives in partnership with engineering and product teams
• Utilize risk management frameworks (NIST CSF, ISO 27005, FAIR) to quantify and communicate risk
Cloud Security & Infrastructure Risk

• Assess security risks associated with cloud environments (AWS, Azure, GCP) and hybrid infrastructure
• Evaluate cloud architecture designs and configurations for security and compliance risks
• Partner with cloud engineering teams to implement security controls and risk mitigation measures
• Review and assess risks related to cloud migration projects and infrastructure changes
Vulnerability & Threat Management

• Oversee vulnerability management program effectiveness and risk prioritization
• Analyze vulnerability scan results and penetration test findings to assess enterprise risk exposure
• Work with IT and security teams to ensure timely remediation of critical vulnerabilities
• Monitor threat intelligence and assess potential impact to the organization
• Evaluate the effectiveness of security controls in mitigating identified vulnerabilities
Third-Party & Vendor Risk Management

• Conduct cybersecurity risk assessments of third-party vendors, suppliers, and business partners
• Review vendor security questionnaires, certifications, and audit reports
• Assess risks associated with vendor access to systems and data
• Monitor ongoing third-party risk and ensure compliance with security requirements
• Support vendor risk remediation efforts and contract security requirements
Governance, Compliance & Policy

• Ensure compliance with relevant cybersecurity regulations, standards, and frameworks (SOC 2, ISO 27001, NIST, Sox, etc.)
• Support the development and maintenance of cybersecurity policies, standards, and procedures
• Participate in internal and external audits related to cybersecurity and risk management
• Monitor regulatory changes and assess impact on organizational risk posture
• Contribute to the organization's cybersecurity governance structure and risk committee activities
Executive Reporting & Metrics

• Prepare comprehensive cyber risk reports and presentations for executive leadership, board of directors, and key stakeholders
• Develop and maintain cyber risk dashboards with Key Risk Indicators (KRIs) and Key Performance Indicators (KPIs)
• Communicate complex cybersecurity risks in business terms to non-technical executive audiences
• Provide regular updates on risk trends, threat landscape, and mitigation progress
• Present risk-based recommendations to support strategic business decisions
Strategic Partnership & Advisory

• Partner with engineering, IT, security, and product teams on new initiatives and technology implementations
• Provide expert cybersecurity risk guidance during project planning and system design phases
• Advise business units on cyber risk implications of strategic decisions and initiatives
• Collaborate with cross-functional teams including legal, compliance, privacy, and internal audit
Emerging Technology & AI Governance

• Assess cybersecurity and privacy risks associated with AI/ML systems and emerging technologies
• Support the development of AI governance frameworks and responsible AI practices
• Evaluate risks related to AI implementation including data privacy, model security, and ethical considerations
• Stay current with emerging technology risks and evolving regulatory requirements
Required Qualifications

Education & Experience

• Bachelor's degree in Cybersecurity, Information Security, Risk Management, Computer Science, Information Technology, or related field
• 5-8 years of progressive experience in cybersecurity risk management, information security, or IT risk
• Proven track record of conducting enterprise-level cyber risk assessments in complex technology environments
• Experience with cloud security risk assessment and cloud platforms (AWS, Azure, GCP)
• Demonstrated experience in third-party risk management and vendor security assessments
Professional Certifications

Required (at least one):

• CRISC (Certified in Risk and Information Systems Control)
• CISSP (Certified Information Systems Security Professional)
• CISM (Certified Information Security Manager)
Preferred:

• CISA (Certified Information Systems Auditor)
• CGRC (Certified in Governance, Risk and Compliance)
• CCSP (Certified Cloud Security Professional)
• Additional relevant cybersecurity or risk management certifications
Cybersecurity & Technical Skills

• Deep understanding of cybersecurity principles, threats, vulnerabilities, and attack vectors
• Strong knowledge of risk management frameworks (NIST, ISO 27001, Soc2, Sox)
• Experience with vulnerability management tools and processes
• Understanding of cloud security architecture and controls (AWS, Azure, GCP)
• Knowledge of security controls, defense-in-depth strategies, and compensating controls
• Familiarity with compliance frameworks (SOC 2, ISO 27001, NIST 800-53)
• Experience with GRC (Governance, Risk, and Compliance) platforms
• Understanding of network security, application security, and infrastructure security

Department: Informa TechTarget
Function: Information Technology
Experience Level: Mid-Senior Level