Cybersecurity Risk Analyst (GRC)

Insight Global (United States); Norfolk (VA); On-site; USD 55,000 - 83,000; Full time

Job summary

Insight Global is seeking an experienced cybersecurity risk professional to conduct comprehensive risk assessments across applications, systems, and enterprise initiatives. The role involves leading HIPAA Security Risk Assessments (SRA) and HICP assessments, documenting findings, and guiding remediation priorities with stakeholders.

You'll evaluate risks using ISO, COBIT, and NIST frameworks, manage risk registers in ServiceNow, and oversee policy exception processes while communicating

Qualifications

• 4+ years in cybersecurity risk management, with enterprise-level risk assessments.
• Bachelor’s degree in Cybersecurity, IT, Computer Science, or related field or equivalent certifications.
• Hands-on experience with GRC platforms, especially ServiceNow risk and compliance modules.
• Experience conducting HIPAA/HICP risk assessments and mitigations.
• Ability to manage multiple projects and work with cross-functional teams.
• Certifications such as CRISC, CISM, CISSP, or CISA preferred.

Responsibilities

• Conduct comprehensive risk assessments across applications, systems, and enterprise initiatives.
• Lead or support HIPAA Security Risk Assessments (SRA) and/or HICP assessments, documenting findings and remediation priorities.
• Perform risk ratings using ISO, COBIT, and NIST frameworks in collaboration with stakeholders.
• Develop and implement risk mitigation aligned with NIST, ISO 27001, HIPAA.
• Utilize ServiceNow to manage risk registers, remediation plans, reports, and metrics.
• Manage policy exception processes including documentation and approvals.

Skills

Risk management

HIPAA

NIST

ServiceNow

GRC tooling

Policy management

Stakeholder collaboration

Education

Bachelor’s degree in cybersecurity or related field

Tools

ServiceNow – Risk/Compliance

Job description

Job Description

Responsibilities

• Conduct comprehensive risk assessments across applications, systems, and enterprise-wide initiatives to identify potential threats, vulnerabilities, and their impact on confidentiality, integrity, and availability of data.
• Lead or support the execution of HIPAA Security Risk Assessments (SRA) and/or HICP assessments, including documenting findings, recommending corrective actions, and ensuring ongoing compliance.
• Independently conduct risk rating for issues using ISO, COBIT, NIST frameworks in partnership with other stakeholders. Additionally, guide and facilitate diverse business units in performing their own risk ratings to help them understand risk implications and remediation priorities.
• Collaborate with the stakeholders in developing and implementing risk mitigation strategies aligned with industry standards and best practices such as NIST, ISO 27001, and HIPAA.
• Utilize Governance, Risk, and Compliance (GRC) tools—specifically ServiceNow—to manage risk registers, track remediation plans, automate workflows, and generate reports on risk status and compliance metrics.
• Manage and oversee policy exception processes, including documentation, risk analysis, and tracking.

Pay rate between $40-60/hr

Skills and Requirements

• At least 4+ years of experience in cybersecurity risk management, including performing risk assessments at both application and enterprise levels.
• Bachelor’s degree in Cybersecurity, Information Technology, Computer Science, or a related field—or equivalent industry training and certifications.
• Hands-on experience with GRC platforms, particularly ServiceNow, including modules related to risk, compliance, and policy management.
• Demonstrated expertise in conducting risk assessments and developing mitigation strategies aligned with HIPAA, NIST, and ISO 27001.
• Experience with HIPAA Security Risk Assessments and/or HICP assessments.
• Proven ability to work independently, manage multiple projects, and collaborate with cross-functional teams.
• Experience managing policy exceptions, including evaluating risks and ensuring proper documentation and approvals.
• Skilled in drafting procedures and operational documentation related to cybersecurity risk and compliance processes.
• Strong understanding of security principles, technical controls, and common attack vectors.
• Excellent communication, interpersonal, and presentation skills with the ability to effectively engage technical and non-technical stakeholders across all levels.
• Strong analytical, problem-solving, and critical thinking abilities.
• A solid understanding of regulations such as HIPAA—including experience with HIPAA Security Assessments or Health Industry Cybersecurity Practices (HICP) assessments—is preferred.
• Relevant industry certifications such as CRISC, CISM, CISSP, or CISA.
• Experience working in a regulated industry, particularly healthcare.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal employment opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment without regard to race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or the recruiting process, please send a request to [e-mail].