Senior Cyber Risk Assessment Specialist

EX Squared LATAM; Región Centro; Hybrid; MXN 600,000 - 900,000; Full time

Benefits offered by this job

Annual performance review with salary/

Savings fund

Vacation premium and statutoryBenefits

Financial support for courses and cert

Remote-work allowance

Job summary

EX Squared LATAM is supporting our client in Mexico with a direct payroll C-level security risk role. The Senior Cyber Risk Assessment Specialist will perform security reviews, IT risk assessments, and comparative audits across projects, vendors, and tech environments.

The role emphasizes interpreting security reports from SOC, Penetration Testing, and Vulnerability Management, and communicating clear risk findings to stakeholders within a global context.

Qualifications

• 3–5 years of experience performing Security Reviews, IT Risk Assessments, IT Audits, Risk Audits, or similar activities.
• Experience reviewing and interpreting SOC, Penetration Testing, and Vulnerability Management reports.
• Broad understanding of information security domains including application security, security architecture, secure coding concepts, access control, data protection, cryptography, monitoring, vulnerability management.

Responsibilities

• Perform Security Reviews, IT Risk Assessments, IT Audits, and related security evaluation activities for projects, vendors, applications, and environments.
• Evaluate security posture against established standards, policies, methodologies, and control objectives.
• Review and interpret technical documentation and reports from Penetration Testing, SOC, and Vulnerability Management teams.
• Identify security and control gaps and assess their impact within the broader risk assessment.
• Escalate issues and maintain documentation suitable for audits.

Skills

Security reviews

IT risk assessments

IT audits

Risk audits

Understanding security reports

Education

Bachelor's or higher in a related field

Tools

SOC reports

Vulnerability management reports

Penetration testing reports

Regulatory frameworks (NIST ISO PCI HIPAA)

Job description

At EX Squared LATAM, we partner with leading organizations across global and regional markets to connect exceptional professionals with high-impact career opportunities.

Our client is a leading global organization in the professional services and consulting industry, supporting businesses with complex technology, cybersecurity, risk, compliance, and transformation initiatives.

For this position, EX Squared LATAM is supporting our client with the recruitment and selection process. The selected professional will be hired directly by the client under their local payroll in Mexico, becoming part of their internal team.

Role Overview

We’re currently looking for a Senior Cyber Risk Assessment Specialist to perform security reviews and IT risk assessments across projects, vendors, applications, and technology environments.

This is an Individual Contributor role focused on assessing security posture, reviewing technical evidence, identifying control gaps, and determining whether projects and third parties align with established security standards, policies, methodologies, and control requirements.

The ideal candidate will bring approximately 3–5 years of experience in Security Reviews, IT Risk Assessments, IT Audits, Risk Audits, or similar activities, along with enough technical cybersecurity knowledge to interpret findings and reports produced by specialized teams such as Penetration Testing, SOC, and Vulnerability Management.

This position does not perform Penetration Testing or Ethical Hacking directly. Instead, the professional must be able to understand technical security reports and use that information as part of broader risk and control assessments.

Company Title

Senior Associate – Security Risk Management - Cyber Assessment

Location

• For professionals based in Mexico City or Guadalajara, the position follows a hybrid model with onsite attendance approximately 2–3 days per week.
• Candidates based in other cities in Mexico may be considered for a remote arrangement; however, Mexico City and Guadalajara profiles will receive priority.

Contract Duration

Permanent, direct employment with the client.

This is a 100% payroll position in Mexico.

Working Hours

Monday through Friday, 8:00 a.m. to 5:00 p.m. EST.

Language Requirement

Advanced English.

Candidates must be comfortable conducting business and technical conversations with both technical and administrative stakeholders, including U.S.-based teams.

What you'll do

• Perform Security Reviews, IT Risk Assessments, IT Audits, and related security evaluation activities for projects, vendors, applications, and technology environments.
• Evaluate security posture against established standards, policies, methodologies, control objectives, and security best practices.
• Review and interpret technical documentation and reports generated by teams such as Penetration Testing, Security Operations Centers (SOC), and Vulnerability Management.
• Identify potential security and control gaps and evaluate their impact within the broader risk assessment.
• Assess security considerations across areas such as application security, architecture, access control, cryptography, data protection, monitoring, vulnerabilities, and secure development practices.
• Review projects and vendors against relevant information security and regulatory requirements.
• Work with technical and business stakeholders to clarify findings, collect supporting evidence, and communicate security requirements.
• Document assessments, findings, risks, and recommendations clearly and accurately.
• Escalate issues when appropriate and maintain documentation that can withstand internal or external audit review.
• Manage multiple concurrent assessments and priorities in a customer-focused and collaborative environment.
• Stay current with evolving information security requirements, threats, technologies, controls, and practices.

What you'll bring

• Approximately 3–5 years of experience performing Security Reviews, IT Risk Assessments, IT Audits, Risk Audits, or similar activities.
• Experience reviewing and interpreting SOC, Penetration Testing, and Vulnerability Management reports.
• Broad understanding of multiple information security domains, including:
• Application security
• Security architecture
• Secure coding concepts
• Access control
• Data protection
• Cryptography
• Monitoring
• Vulnerability management
• Understanding of security principles, IT security controls, and related technologies and products.
• Knowledge of the OWASP Top 10 web application security risks.
• Familiarity with standards and regulatory frameworks such as NIST 800 series, ISO 27000, PCI-DSS, and HIPAA.
• Familiarity with security technologies such as Active Directory, LDAP, Okta or other access management solutions, IDS, firewalls, load balancers, proxies, DLP, Qualys, Carbon Black, Symantec CCS, or comparable technologies.
• Strong analytical, troubleshooting, organizational, and documentation skills.
• Ability to prioritize and manage multiple projects or assessments simultaneously.
• Strong written and verbal communication skills and the ability to collaborate effectively with stakeholders at different organizational levels.

What will make you stand out

• Experience with GRC platforms such as Archer.
• Certifications such as CISSP, CCSP, CISA, CCSK, or similar credentials.
• Strong experience reviewing third-party or vendor security risks.
• Exposure to several cybersecurity domains rather than expertise limited to only one technical area.
• Experience working with U.S.-based or multicultural teams.
• Ability to take highly technical security findings and translate them into understandable risk, control, and business implications.
• Experience operating in environments where assessments and documentation may be subject to internal or external audit.

Why this opportunity?

This is an opportunity to join a large, globally recognized organization in the professional services and consulting industry, working with multidisciplinary and international teams on cybersecurity and technology risk initiatives.

The role provides exposure to a broad range of security domains, enterprise technologies, projects, and vendors while allowing the professional to develop deeper expertise in Security Risk Management, security assessments, IT controls, and cybersecurity governance.

It is particularly well suited for someone who enjoys understanding technical security issues but wants to apply that knowledge from a risk assessment and advisory perspective rather than an offensive security role.

What the Client Offers

• Annual performance review with potential salary adjustments and internal growth.
• Savings fund.
• Vacation premium and statutory benefits.
• Financial support for courses and professional certifications.
• Remote-work allowance, when applicable.

Eligibility Note

This opportunity is available to candidates currently residing in Mexico.

Candidates located in Mexico City and Guadalajara are strongly preferred due to the hybrid working model. Candidates located elsewhere in Mexico may also be considered for remote work depending on profile and business requirements.