Cyber Risk Specialist II

Jabil Inc.; Saint Petersburg (FL); On-site; USD 95,000 - 140,000; Full time

Job summary

Jabil Inc. in Saint Petersburg, FL is seeking a Cyber Risk Specialist to join the Cybersecurity GRC team. You will identify, assess, and report cyber risks across the organization, focusing on KRIs, KPIs, and security metrics to inform leadership decisions.

You will translate technical data into business insights, support risk governance, and drive ongoing improvement in cyber risk measurement and reporting through collaboration with IT, security, and business stakeholders.

Qualifications

• Bachelor’s degree in Cybersecurity, IT, or related field, or equivalent practical experience.
• 3+ years in cybersecurity, IT risk, or cyber risk management.
• Experience developing, managing, or reporting cybersecurity metrics and dashboards.
• Strong understanding of cybersecurity principles, threats, vulnerabilities, controls, and risk management concepts.
• Familiarity with risk frameworks such as NIST CSF, RMF, ISO 27001/27005, COBIT, and FAIR.

Responsibilities

• Identify, assess, and document cybersecurity risks across systems, apps, third parties, cloud environments, and processes.
• Develop and maintain cyber risk metrics, dashboards, scorecards, and reporting for technical and executive audiences.
• Prepare recurring and ad hoc risk reports for governance, audits, and regulatory assessments.
• Collaborate with vulnerability management, security operations, compliance, and IT teams to align reporting.

Skills

Cybersecurity

Risk management

Data analytics

Reporting

Stakeholder communication

Education

Bachelor’s degree in Cybersecurity

Tools

Excel

Power BI

GRC tools

SIEM

Vulnerability scanners

Job description

Job Summary The Cyber Risk Specialist is a member of the Cybersecurity GRC team responsible for identifying, assessing, analyzing, and reporting on cyber risks across the organization, with a specialized focus on risk metrics. This role supports the development and maintenance of a data-driven cyber risk program by collecting, validating, analyzing, and communicating key risk indicators (KRIs), key performance indicators (KPIs), and other security metrics that inform leadership decision-making. The ideal candidate combines cybersecurity knowledge with strong analytical, reporting, and stakeholder communication skills. This individual will help translate technical security data into meaningful business insights, support risk governance activities, and drive continuous improvement in cyber risk measurement and reporting.

Job Summary The Cyber Risk Specialist is a member of the Cybersecurity GRC team responsible for identifying, assessing, analyzing, and reporting on cyber risks across the organization, with a specialized focus on risk metrics. This role supports the development and maintenance of a data-driven cyber risk program by collecting, validating, analyzing, and communicating key risk indicators (KRIs), key performance indicators (KPIs), and other security metrics that inform leadership decision-making. The ideal candidate combines cybersecurity knowledge with strong analytical, reporting, and stakeholder communication skills. This individual will help translate technical security data into meaningful business insights, support risk governance activities, and drive continuous improvement in cyber risk measurement and reporting.

Key Responsibilities

Cyber Risk Analysis

• Identify, assess, and document cybersecurity risks related to systems, applications, third parties, cloud environments, and business processes.
• Perform qualitative and quantitative cyber risk assessments using established risk frameworks and methodologies.
• Analyze control effectiveness and residual risk in coordination with cybersecurity, IT compliance, IT operations and business stakeholders.
• Maintain cyber risk registers and ensure risk records are current, complete, and aligned with organizational standards.
• Support exception management, risk acceptance processes, and remediation tracking.

Risk Metrics Management

• Develop, maintain, and enhance cyber risk metrics, dashboards, scorecards, and reporting packages for technical teams, leadership, and executive stakeholders.
• Define and monitor KRIs, KPIs, KCIs (Key Control Indicators), and trending metrics that measure cyber risk exposure and control performance.
• Collect data from multiple security and IT sources such as vulnerability management tools, SIEM platforms, GRC tools, endpoint security systems, audit findings, and incident records.
• Validate data quality, normalize metrics, and ensure reporting consistency across teams and reporting periods.
• Establish thresholds, escalation criteria, and tolerance levels for cyber risk indicators.
• Perform trend analysis and identify emerging risks, recurring control issues, and areas requiring management attention.
• Create visualizations and summaries that clearly communicate cyber risk posture to both technical and non-technical audiences.

Reporting and Governance

• Prepare recurring and ad hoc risk reports for governance committees, management reviews, audits, and regulatory assessments.
• Support the organization’s cyber risk governance framework by providing timely and accurate reporting on risk posture and control performance.
• Assist with board-level or executive-level reporting by translating technical findings into business-focused risk narratives.
• Contribute to policy, standards, and procedure updates related to cyber risk measurement, documentation, and reporting.

Cross-Functional Collaboration

• Partner with vulnerability management, security operations, compliance, internal audit, enterprise risk, and IT teams to gather data and align reporting.
• Work with business stakeholders to understand operational context and improve risk measurement relevance.
• Support risk remediation planning by helping prioritize issues based on impact, exposure, and trend data.
• Participate in assessments related to third-party risk, cloud risk, application risk, and operational resilience as needed.

Continuous Improvement

• Recommend and implement enhancements to cyber risk measurement methodologies, reporting automation, and dashboard design.
• Improve data collection processes and help integrate metrics into GRC or security reporting platforms.
• Stay current on cybersecurity threats, risk management practices, industry standards, and emerging metrics approaches.

Required Qualifications

• Bachelor’s degree in Cybersecurity, Information Technology, Information Systems, Risk Management, Data Analytics, or a related field (or equivalent practical experience).
• 3+ years of experience in cybersecurity, IT risk, information security governance, or cyber risk management.
• Experience developing, managing, or reporting on cybersecurity metrics, risk indicators, or dashboards.
• Strong understanding of cybersecurity principles, threats, vulnerabilities, controls, and risk management concepts.
• Experience with risk frameworks and standards such as:
  • NIST Cybersecurity Framework (CSF)
  • NIST Risk Management Framework (RMF)
  • ISO 27001 / ISO 27005
  • COBIT
  • FAIR
• Proficiency in analyzing data and creating reports using tools such as Excel, Power BI, or similar reporting platforms.
• Experience working with security and risk data sources such as GRC tools, vulnerability scanners, SIEMs, ticketing systems, or audit repositories.
• Strong written and verbal communication skills, with the ability to present technical information in a business-friendly manner.
• Strong attention to detail, organizational skills, and analytical thinking.

Preferred Qualifications

• Experience in the manufacturing industry.
• Familiarity with control testing, audit support, compliance requirements, and issue management.
• Hands‑on experience with tools such as OneTrust, Splunk, Qualys, Tenable, Nozomi or similar platforms.
• Knowledge of quantitative risk analysis methods and cyber risk scoring models.
• Experience with data automation, scripting, or querying tools such as SQL, Python, or PowerShell.
• Relevant certifications preferred, such as:
  • CRISC
  • CISM
  • CISSP
  • Security+
  • CISA
  • FAIR certification