Cyber Security Risk Analyst

UL, LLC; Northbrook (IL); On-site; USD 86,000 - 115,000; Full time

Benefits offered by this job

Health benefits

Wellness benefits

401K

Paid time off

Job summary

UL Solutions is seeking a Global Cybersecurity Risk Analyst to identify, assess, communicate, and manage cybersecurity and information risks across the organization. You will help ensure operations, technologies, and third-party relationships are evaluated and mitigated to reduce risk exposure and business impact.

The role involves documenting risks, tracking remediation, and guiding stakeholders on risk acceptance or mitigation.

Qualifications

• Bachelor’s or master’s degree in business, Computer Science, Cybersecurity, Information Security, or related field.
• 2+ years of experience in cybersecurity, information security, technology risk, or related risk management role.
• 2+ years of experience managing risk and compliance matters or supporting applications, coordinating MSP activities, projects, systems, or third-party relationships requiring risk identification, assessment, remediation, and monitoring.
• Demonstrated understanding of operational, cybersecurity, information security, and technology risks.
• Strong business acumen with ability to assess cybersecurity risks and impacts in context of objectives.
• Experience evaluating complex third-party risks through vendor risk management, information security, regulatory compliance, or audit activities.
• Hands-on experience using ServiceNow to perform and manage Vendor Risk Assessments.
• Experience with frameworks such as ISO/IEC 27001, COBIT, NIST CSF, NIST SP 800-series, and FAIR.

Responsibilities

• Support risk assessments for new and existing technologies, services, initiatives, and third-party providers.
• Identify and document risk scenarios, assets, threats, vulnerabilities, controls, and business impact.
• Communicate findings clearly to risk owners, stakeholders, and cybersecurity teams.
• Provide risk-based guidance on acceptance, mitigation, transfer, or avoidance.
• Recommend controls and risk treatment activities to manage cybersecurity and information risks.
• Identify opportunities to improve risk posture and assist remediation strategies.
• Assess residual risk after implementing mitigating controls.
• Track risks, issues, remediation activities, and risk events through closure.
• Support third‑party/vendor risk lifecycle activities including due diligence and monitoring.
• Respond to external customer cybersecurity questionnaires and ensure regulatory alignment.
• Support risk reporting and documentation for visibility into material risks.

Skills

Risk assessment

Communication

Stakeholder management

Regulatory knowledge

Vendor risk management

Risk reporting

ServiceNow

Frameworks knowledge

Education

Bachelor’s or Master’s in Business/CS/Cybersecurity

Tools

ServiceNow

Job description

The Global Cybersecurity Risk Analyst will support the identification, assessment, communication, and management of cybersecurity and information risks across the organization. This role will help ensure that operational activities, technologies, and third-party relationships are appropriately evaluated and managed to reduce risk exposure and potential business impact.

The Analyst will assess risks associated with business operations and third-party providers, including cybersecurity practices and applicable legal, regulatory, contractual, and industry requirements. The role will also support the documentation, tracking, and reporting of identified risks and issues and help ensure that appropriate mitigation actions are implemented to reduce residual risk to acceptable levels.

• Support focused cybersecurity and information risk assessments for new and existing technologies, services, business initiatives, and third-party providers.
• Identify and document risk scenarios, including relevant assets, threats, vulnerabilities, controls, likelihood, and potential business impact.
• Communicate risk assessment findings clearly and effectively to risk owners, business stakeholders, information governance teams, and cybersecurity teams.
• Provide risk-based guidance that enables stakeholders to make informed decisions regarding risk acceptance, mitigation, transfer, or avoidance.
• Identify and recommend appropriate controls and risk treatment activities to effectively manage cybersecurity and information risks.
• Identify opportunities to improve the organization’s risk posture and assist in developing remediation and mitigation strategies.
• Assess residual risk following the implementation of mitigating or compensating controls.
• Track identified risks, issues, remediation activities, and risk events through closure.
• Support the execution of the third-party/vendor risk management lifecycle, including risk assessments, due diligence, control validation, ongoing monitoring, and remediation tracking.
• Support responses to external customer cybersecurity and information security questionnaires.
• Apply applicable legal, regulatory, contractual, and industry requirements when evaluating cybersecurity and third-party risks.
• Support risk reporting and documentation to provide appropriate visibility into material risks, issues, and remediation activities.
• Bachelor’s or master’s degree in business, Computer Science, Cybersecurity, Information Security, or a related field.
• 2+ years of experience in cybersecurity, information security, technology risk, or a related risk management role.
• 2+ years of experience managing risk and compliance matters or supporting applications, coordinating managed service provider activities, projects, systems, or third-party relationships requiring risk identification, assessment, remediation, and monitoring.
• Demonstrated understanding of operational, cybersecurity, information security, and technology risks.
• Strong business acumen with the ability to assess cybersecurity risks and potential impacts in the context of operational, financial, regulatory, and business objectives.
• Experience evaluating complex third-party risks through vendor risk management, information security, regulatory compliance, or audit activities.
• Hands-on experience using ServiceNow to perform and manage Vendor Risk Assessments.
• Experience working with recognized cybersecurity, risk, and compliance frameworks and methodologies, such as ISO/IEC 27001, COBIT, NIST Cybersecurity Framework, NIST SP 800-series guidance, and FAIR.

What We Offer:

Total Rewards: We understand compensation is an important factor as you consider the next step in your career. The estimated salary range for this position is $86,400-$115,100 USD and is based on multiple factors, including job-related knowledge/skills, experience, geographical location, as well as other factors. This position is eligible for annual bonus compensation with a target payout of 10% of the base salary.

This position also provides health benefits such as medical, dental and vision; wellness benefits such as mental and financial health; and retirement savings (401K) commensurate with the standard rewards offered in each individual location or country. We also provide full-time employees with paid time off including vacation (15 days), holiday and personal days (totaling 12 days) and sick time off (72 hours).

A global leader in applied safety science, UL Solutions (NYSE: ULS) transforms safety, security and sustainability challenges into opportunities for customers in more than 110 countries. UL Solutions delivers testing, inspection and certification services, together with software products and advisory offerings, that support our customers’ product innovation and business growth. The UL Mark serves as a recognized symbol of trust in our customers’ products and reflects an unwavering commitment to advancing our safety mission. We help our customers innovate, launch new products and services, navigate global markets and complex supply chains, and grow sustainably and responsibly into the future. Our science is your advantage.

UL LLC has been and will continue to be an equal opportunity employer. To assure full implementation of this equal employment policy, we will take steps to assure that:

Persons are recruited, hired, assigned and promoted without regard to race, color, age, sex or gender, sexual orientation, gender identity, gender expression, transgender status, religion, creed, national origin, ethnicity, citizenship, ancestry, disability, genetic information, military or veteran status, pregnancy, marital or familial status, or any other protected category under applicable law.