Cyber Risk Analyst

Sun King; New Delhi; Remote; INR 900,000 - 1,500,000; Full time

Job summary

Financeroles is seeking a Cyber Risk Analyst to strengthen governance, risk and compliance. The role involves leading cyber security audits, vendor security reviews, BCP/DR exercises, and ensuring alignment with NIST CSF and ISO 27001 standards.

You will work remotely from India with cross‑functional collaboration and clear stakeholder communication, driving risk mitigation and security culture across the organization.

Qualifications

• Bachelor's degree in engineering and 3+ years in cyber governance, risk and compliance.
• Experience implementing security controls across business functions per NIST CSF and ISO 27001.
• Familiarity with SOC 2, GDPR/DPDP and security certifications is a plus.

Responsibilities

• Plan and execute internal cyber security audits and control reviews across applications, infrastructure, and processes.
• Document findings, assess risk and impact, and track remediation with teams until closure.
• Conduct security due diligence for vendors and third parties; review security questionnaires and controls.
• Maintain and test business continuity and disaster recovery (BCP/DR) plans; coordinate tabletop exercises and corrective actions.
• Maintain up-to-date cyber risk register and produce governance dashboards for management.
• Develop and deliver cyber security awareness sessions and training for employees.

Skills

Cyber risk assessment

Audit management

Vendor risk

BCP/DR planning

NIST CSF

ISO 27001

Security awareness

Education

Bachelor's degree in engineering

Tools

NIST CSF

ISO 27001

Job description

Job location: Remote in India

About the role:

We are looking for a Cyber Risk Analyst to strengthen our governance, risk, and compliance posture across the organization. In this role, the Cyber Risk Analyst will drive cyber security audits, vendor security reviews, business continuity (BCP/DR) drills, and security awareness initiatives, while supporting the implementation of frameworks such as NIST Cybersecurity Framework (CSF) and ISO 27001 ISMS. This role is ideal for someone who enjoys working cross‑functionally, can communicate clearly with both technical and non‑technical stakeholders, and is comfortable working remotely with high ownership and accountability.

Cyber Security Audits & Assessments (30%)

• Plan and execute internal cyber security audits and control reviews across applications, infrastructure, and business processes.
• Document findings, assess risk and impact, and track remediation through closure with respective teams.

Vendor and Third‑party Security Reviews (30%)

• Conduct security due diligence for vendors and third parties: review security questionnaires, certifications, and technical controls to ensure they meet organizational requirements.
• Identify and track vendor risks, recommend mitigation measures, and support contractual security requirements where needed.

Business Continuity and BCP/DR drills (25%)

• Work with stakeholders to maintain and test business continuity and disaster recovery (BCP/DR) plans.
• Plan, coordinate, and document tabletop exercises and technical BCP/DR drills, track and follow up on corrective actions.

Cyber Governance and Risk Management (10%)

• Maintain up‑to‑date security policies, standards, procedures, and guidelines, ensuring alignment with NIST CSF, ISO 27001, and relevant regulations.
• Prepare regular reports and dashboards on audit findings, risk status, BCP drill outcomes, vendor risk posture, and ISMS/NIST CSF progress for management.
• Maintain and update the cyber risk register, working with control owners and business stakeholders to identify, assess, and prioritize risks.
• Perform risk assessments (likelihood/impact), propose risk treatment options (mitigate, accept, transfer, avoid), and track treatment plans to closure.

Cyber Security Awareness & Training (5%)

• Develop and deliver cyber security awareness sessions and targeted training for employees, including phishing awareness, secure handling of data, and role‑based security topics.
• Create clear, engaging communication materials (presentations, FAQs, quick guides) to improve security culture.

• Bachelor's degree in any engineering discipline.
• At least 3 years of experience in cyber governance, risk and compliance domain.
• Experience in implementing security controls and processes across business functions adhering to NIST CSF, ISO 27001 standards.
• Practical experience into at least 70% of the above-mentioned responsibilities.
• Exposure to industry standards and regulations (e.g., SOC 2, ISO 27001, GDPR/DPDP etc.).
• Security certifications such as CISA, ISO 27001 Lead Implementer / Lead Auditor is preferred.
• AI‑governance or AI‑risk credentials such as ISO/IEC 42001 training, NIST AI RMF Architect/Lead Implementer, or recognized AI Security & Governance certifications is a strong plus.
• Good communication and interpersonal skills, with the ability to engage effectively with diverse stakeholders.