Cyber Security Risk Analyst
Remote - Virginia
Full Time Senior-level / Expert USD 72K - 120K
College Board
College Board is a non-profit organization that clears a path for all students to own their future through the AP Program, SAT Suite, BigFuture, and more.Cyber Security Risk Analyst
College Board - Risk Management
Location This is a fully remote role. Candidates who live near CB offices have the option of being fully remote or hybrid (Tuesday and Wednesday in office).
Type: This is a full-time position
About the Team
The Information Security Governance Risk and Compliance (ISGRC) team at the College Board checks and certifies the College Board’s Information Security Programs. Our mission is to provide our stakeholders with meaningful insights that continuously improve the risk posture across the organization.
ISGRC partners work with business leads to perform necessary security reviews of policies, systems, contracts, and vendors to better understand and manage risk. The team also manages security policies, security awareness training, and industry-recognized certifications (ISO 27001, SOC2 and PCI-DSS).
About the Opportunity
As a Security Risk Analyst, you will have the critical role of being responsible for evaluating and managing exceptions to IT security policies, for managing the Organization’s Risk and Control Issues Register (Risk Register), and for developing reports and metrics.
Your strong technical communication and negotiation skills will help you build relationships and collaborate with diverse stakeholders and reduce risk to the organization and ensure compliance.
Under the direction of management, you will manage the Risk Register and perform security policy exceptions to help the College Board understand its critical risks.
In this role you will:
Manage the Risk Register (20%)
Leads the management of the issues and risks and quickly escalates any untimely completion of audit actions.
Works independently to communicate risks and works with others to problem-solve risks to tolerance levels based on data and evidence.
Maintains data quality of Risk Register and executes any required data clean-up exercises.
Understands College Board work to be able to drive Risk or Control Owners to ensure consistent application of policies and standards.
Raises awareness about Risk & Control Issues, Policy exceptions, and available risk reduction options.
Fosters a culture of risk awareness and compliance within the technology department and across the organization.
Manage Policy Exceptions (65%)
Independently analyzes policy exception submissions and provide risk assessment reports for critical service lines, applications, and infrastructure hosted on-prem and in the cloud.
Evaluates and manage exceptions to IT security policies.
Manages materials for the Exception Review Board and present exception information to executive leadership and senior team members.
Maintains an up-to-date knowledge and understanding of IT security policies and principles.
Maintains a customer-focused attitude in all interactions with customers and colleagues.
Manage Metrics and Reporting (15%)
Provides weekly and monthly reporting for the Risk Register and policy exceptions.
Produces trending metrics and escalate exceptions.
Performs other duties as assigned.
About You
5-7 years of experience managing or supporting IT Security Risk and Control Risk Register and processing policy exceptions.
Strong understanding of risk management techniques such as: risk identification, risk scoring, risk mitigation, and risk tracking.
The proven ability to lead conversations balancing risk and multiple business needs that result in positive outcomes with multiple stakeholders.
The capacity to assess risk information and make risk recommendations independently.
Strong organization and prioritization skills and the proven ability to manage multiple tasks simultaneously, both independently and as a member of the team.
7-10 years of experience in information security; governance, risk, and compliance; and/or information technology projects.
Excellent verbal and written communication skills.
Experience with governance, risk, and compliance tools (e.g., RSAM, RSA Archer) preferred.
Experience with information security and privacy frameworks such as ISO 27001, COBIT, NIST-CSF, NIST 800-53, GDPR etc.
Current Information Security Certification (e.g., CISSP, CRISC, CISM, CISA, or related security certification) preferred or the ability to attain one within 6 months of hire.
Bachelor’s degree in computer science, cybersecurity, engineering, IT management or four years equivalent IT and security industry experience.
For remote positions, ability to travel 4 times a year to our Reston, VA office.
Authorization to work for any employer in the USA
About Our Process
Application review will begin immediately and will continue until the position is filled
While the hiring process may vary, it generally includes: resume and application submission, recruiter phone screen, hiring manager interview, performance exercise and/or panel interview, and reference checks. This is an approximately 8-week process
About Our Benefits and Compensation
College Board offers a competitive benefits and compensation program that attracts top talent looking to make a difference in education. As a self-sustaining non-profit, we believe in compensating employees equitably in relation to each other, their qualifications, their impact, and the relevant market.
The hiring range for a new employee in this position is $72000 to $120000. College Board differentiates salaries by location so where you live will narrow the portion of this range in which you can expect a salary.
Your salary will be carefully determined based on your location, relevant experience, the external labor market, and the pay of College Board employees in similar roles. College Board strives to provide our best offer up front based on this criteria.
Your salary is only one part of all that College Board offers, including but not limited to:
A comprehensive package designed to support the well-being of employees and their families and promote education. Our robust benefits package includes health, dental, and vision insurance, generous paid time off, paid parental leave, fertility benefits, pet insurance, tuition assistance, retirement benefits, and more
Recognition of exceptional performance through annual bonuses, salary growth over time through market increases, and opportunities for merit raises and promotions based on increased scope of responsibility
A job that matters, a team that cares, and a place to learn, innovate and thrive
You can expect to have transparent conversations about benefits and compensation with our recruiters throughout your application process.
#LI-MD1
Tags: CISA CISM CISSP Cloud COBIT Compliance Computer Science CRISC GDPR Governance ISO 27001 NIST NIST 800-53 Privacy Risk assessment Risk Assessment Report Risk management RSA SOC 2 Travel
Perks/benefits: Career development Competitive pay Fertility benefits Health care Parental leave Salary bonus
More jobs like this
Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
- Open Information Security Officer jobs
- Open Information Security Specialist jobs
- Open Information Systems Security Officer (ISSO) jobs
- Open Senior Cyber Security Engineer jobs
- Open Ethical hacker / Pentester H/F jobs
- Open Cyber Security Architect jobs
- Open Cyber Security Specialist jobs
- Open Product Security Engineer jobs
- Open Manager Pentest H/F jobs
- Open Cybersecurity Analyst jobs
- Open Staff Security Engineer jobs
- Open Chief Information Security Officer jobs
- Open Consultant infrastructure sécurité H/F jobs
- Open Senior Information Security Analyst jobs
- Open Security Specialist jobs
- Open Senior Information Security Engineer jobs
- Open Cybersecurity Consultant jobs
- Open Senior Penetration Tester jobs
- Open Consultant SOC / CERT H/F jobs
- Open IT Security Analyst jobs
- Open Security Researcher jobs
- Open Sr. Security Engineer jobs
- Open Security Operations Analyst jobs
- Open Cybersecurity Specialist jobs
- Open IT Security Engineer jobs
- Open CISM-related jobs
- Open Windows-related jobs
- Open Network security-related jobs
- Open Pentesting-related jobs
- Open ISO 27001-related jobs
- Open Application security-related jobs
- Open Agile-related jobs
- Open GCP-related jobs
- Open Vulnerability management-related jobs
- Open CISA-related jobs
- Open Analytics-related jobs
- Open IAM-related jobs
- Open Threat intelligence-related jobs
- Open SaaS-related jobs
- Open Security assessment-related jobs
- Open APIs-related jobs
- Open Malware-related jobs
- Open Java-related jobs
- Open Forensics-related jobs
- Open Security Clearance-related jobs
- Open DevOps-related jobs
- Open CEH-related jobs
- Open IDS-related jobs
- Open EDR-related jobs
- Open Kubernetes-related jobs