Cyber Risk Analyst

Jobgether; United States; Remote; USD 90,000 - 130,000; Full time

Benefits offered by this job

Fully remote (India)

Permanent full-time employment

Professional growth

Learning and development

Collaborative culture

International exposure

Purpose-driven work

Job summary

Jobgether is seeking an experienced cybersecurity governance, risk, and compliance professional to lead audits, vendor risk reviews, and BCP/DR initiatives across business functions. You will document findings, coordinate remediation, and report on ISMS progress.

Ideal candidates hold a bachelor's in engineering, 3+ years in GRC, familiarity with NIST CSF and ISO 27001, and certifications like CISA. This fully remote role offers international collaboration and growth in a purpose-driven energy

Qualifications

• A bachelor's degree in an engineering discipline.
• At least three years of professional experience in cybersecurity governance, risk, and compliance (GRC).
• Practical experience implementing security controls and processes across business functions aligned with NIST CSF and ISO 27001.
• Hands-on experience with security audits, third-party risk assessments, business continuity planning, and risk management.
• Familiarity with SOC 2, ISO 27001, GDPR, and DPDP frameworks.
• The ability to conduct structured risk assessments and coordinate remediation with multiple stakeholders.
• Strong written and verbal communication, with the ability to explain concepts to both technical and non-technical audiences.
• Proactive, organized, and capable of independent work in a remote environment.
• Preferred certifications: CISA, ISO 27001 Lead Implementer, or Lead Auditor.

Responsibilities

• Cybersecurity audits and assessments: Plan and conduct internal audits across applications, infrastructure, and processes.
• Vendor and third-party risk management: Review security questionnaires and contracts to mitigate risks.
• Business continuity and disaster recovery: Maintain and test BCP/DR plans with tabletop exercises.
• Cyber governance and compliance: Align policies with NIST CSF, ISO 27001, and regulatory requirements.
• Risk assessment and treatment: Maintain risk registers and prioritize mitigation strategies.
• Management reporting: Prepare dashboards on audit findings, exposure, and ISMS progress.
• Security awareness: Develop training on phishing, data handling, and role-specific security.
• Security communications: Create clear awareness materials and quick-reference guides.
• Continuous improvement: Identify opportunities to improve security controls and governance processes.

Skills

GRC experience

Analytical thinking

Written & verbal communication

Stakeholder management

Remote work capability

Structured risk assessments

Problem solving

Explain cybersecurity to non-technical

Education

Bachelor's degree in engineering

Job description

Accountabilities

• Cybersecurity audits and assessments: Plan and conduct internal cybersecurity audits and control reviews across applications, infrastructure, and business processes. Document findings, evaluate potential impacts, and coordinate remediation activities with relevant teams through to closure.
• Vendor and third-party risk management: Perform security due diligence for vendors and external partners by reviewing security questionnaires, certifications, policies, and technical controls. Identify potential risks, recommend mitigation measures, and support the inclusion of appropriate security requirements in contracts when necessary.
• Business continuity and disaster recovery: Collaborate with stakeholders to maintain, validate, and improve business continuity and disaster recovery (BCP/DR) plans. Organize tabletop exercises and technical drills, document outcomes, and track corrective actions to completion.
• Cyber governance and compliance: Maintain and improve security policies, standards, procedures, and guidelines, ensuring alignment with NIST Cybersecurity Framework, ISO 27001, and applicable regulatory requirements.
• Risk assessment and treatment: Maintain the cybersecurity risk register and work with control owners and business stakeholders to identify, assess, and prioritize risks. Evaluate likelihood and impact, recommend appropriate treatment strategies, and monitor mitigation plans through resolution.
• Management reporting: Prepare reports and dashboards covering audit findings, risk exposure, vendor security assessments, business continuity exercise results, and progress toward ISMS and NIST CSF objectives.
• Security awareness and training: Develop and deliver employee awareness sessions and targeted training on topics such as phishing prevention, secure data handling, and role-specific security responsibilities.
• Security communications: Create clear, engaging awareness materials, including presentations, FAQs, and quick-reference guides, to encourage secure behaviors and strengthen the organization's security culture.
• Continuous improvement: Identify opportunities to improve security controls, governance processes, risk reporting, and cross-functional collaboration while supporting the effective implementation of cybersecurity standards and best practices.

Requirements

• A bachelor's degree in an engineering discipline.
• At least three years of professional experience in cybersecurity governance, risk, and compliance (GRC).
• Practical experience implementing security controls and processes across business functions in alignment with frameworks such as NIST Cybersecurity Framework and ISO 27001.
• Hands-on experience with a substantial portion of the responsibilities outlined for this role, ideally including security audits, third-party risk assessments, business continuity planning, and risk management.
• Familiarity with relevant industry standards and regulatory requirements, such as SOC 2, ISO 27001, GDPR, and India's Digital Personal Data Protection (DPDP) framework.
• The ability to conduct structured risk assessments, document findings, recommend mitigation strategies, and coordinate remediation activities with multiple stakeholders.
• Strong analytical and problem-solving skills, with the ability to assess technical and operational risks and translate findings into actionable recommendations.
• Excellent written and verbal communication skills, including the ability to explain cybersecurity concepts and compliance requirements to both technical and non-technical audiences.
• Strong interpersonal and stakeholder management skills, with the ability to collaborate across departments and engage effectively with vendors and control owners.
• A proactive, organized, and accountable working style, with the ability to manage multiple priorities and work independently in a remote environment.
• Preferred certifications: CISA, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor.
• Additional advantage: Training or certifications in AI governance and AI risk management, such as ISO/IEC 42001, NIST AI Risk Management Framework (AI RMF), or recognized AI security and governance programs.

Benefits

• Fully remote work: Work remotely from India.
• Permanent, full-time employment: An opportunity to build a long-term career in cybersecurity governance, risk management, and compliance.
• Professional growth: Develop expertise in security audits, vendor risk management, business continuity, and recognized cybersecurity frameworks.
• Learning and development: Access to structured development opportunities designed to strengthen professional, leadership, and management capabilities.
• Collaborative culture: Work with colleagues across technical and business functions in an open-minded, innovation-focused environment.
• International exposure: Collaborate with professionals from different countries, cultures, and backgrounds.
• Purpose-driven work: Contribute to an organization focused on expanding access to affordable, reliable energy and delivering positive social and environmental impact.