Cybersecurity Specialist

Cypress HCM; Northbrook (IL); Hybrid; USD 62,000 - 76,000; Full time

Job summary

Cypress HCM is seeking a Global Cybersecurity Risk Analyst to support enterprise information security, risk, and third‑party risk management initiatives. You will assess risks related to technologies, initiatives, applications, and external vendors, helping stakeholders understand exposures and drive informed risk decisions.

The ideal candidate brings hands-on risk assessment experience with vendor risk management, security controls, and regulatory requirements.

Qualifications

• Bachelor’s degree or equivalent in cybersecurity, information security, or related field.
• 2+ years in cybersecurity, information security, GRC, or related area.
• Experience with Vendor Risk Management and risk assessments.
• Familiarity with NIST, ISO 27001, COBIT, or FAIR frameworks.

Responsibilities

• Conduct cybersecurity and information risk assessments for technologies, apps, and third‑party providers.
• Document risk scenarios, assets, threats, vulnerabilities, controls, likelihood, and impacts.
• Evaluate security controls and advise remediation and compensating controls.
• Communicate findings to business stakeholders and risk owners.
• Support risk-based decisions including acceptance, mitigation, transfer, and avoidance.
• Maintain risk registers and track remediation activities through closure.
• Use ServiceNow for vendor risk assessments and documentation.

Skills

Analytical thinking

Communication

Multitasking

Risk documentation

Education

Bachelor’s degree in Business/CS/Cybersecurity/InfoSec

Tools

ServiceNow

Job description

• Work Arrangement: Hybrid (3 Days Onsite)
• Employment Type: Contract-to-Hire
• Experience Level: Mid-Level

Job Overview

• Global Cybersecurity Risk Analyst
• Location: Northbrook, IL
• Work Arrangement: Hybrid (3 Days Onsite)
• Employment Type: Contract-to-Hire
• Experience Level: Mid-Level

Position Overview

• We are seeking a Global Cybersecurity Risk Analyst to support enterprise cybersecurity, information risk, and third-party risk management initiatives. This individual will assess risks associated with technologies, business initiatives, applications, and external vendors, helping stakeholders understand potential exposures and make informed risk management decisions.
• The ideal candidate combines hands‑on cybersecurity risk assessment experience with a strong understanding of vendor risk management, security controls, and regulatory requirements. Experience using ServiceNow to conduct and manage vendor risk assessments is particularly important.

Key Responsibilities

• Conduct cybersecurity and information risk assessments for new and existing technologies, applications, business initiatives, and third‑party providers.
• Identify, document, and evaluate risk scenarios, including assets, threats, vulnerabilities, existing controls, likelihood, and potential business impact.
• Evaluate security controls and determine inherent and residual risk, recommending appropriate mitigation strategies and compensating controls.
• Communicate risk findings and recommendations to business stakeholders, risk owners, information governance teams, and cybersecurity partners.
• Support risk‑based decisions involving risk acceptance, mitigation, transfer, and avoidance.
• Manage risk register entries, track identified issues and remediation activities, and monitor risks through resolution.
• Support the third‑party risk management lifecycle, including vendor assessments, due diligence, control validation, ongoing monitoring, and remediation tracking.
• Use ServiceNow to perform and manage vendor risk assessments and maintain accurate risk documentation.
• Assist with customer cybersecurity questionnaires, audit requests, and evidence collection.
• Apply relevant regulatory, contractual, and industry requirements when evaluating cybersecurity and third‑party risks.
• Support risk reporting and identify opportunities to improve the organization’s overall cybersecurity and information risk posture.

Required Qualifications

• Bachelor’s degree in Business, Computer Science, Cybersecurity, Information Security, or a related field; equivalent relevant experience may be considered.
• At least 2 years of experience in cybersecurity, information security, technology risk, governance, risk and compliance (GRC), or a related field.
• At least 2 years of experience supporting risk and compliance activities, technology projects, applications, systems, managed service providers, or third‑party relationships.
• Hands‑on experience using ServiceNow for Vendor Risk Assessments or vendor risk management workflows.
• Experience conducting or supporting cybersecurity risk assessments, evaluating security controls, documenting findings, and tracking remediation activities.
• Understanding of third‑party risk management, information security controls, and technology risk principles.
• Familiarity with cybersecurity and risk management frameworks such as NIST Cybersecurity Framework, NIST SP 800-series, ISO 27001, COBIT, or FAIR.
• Strong analytical, organizational, and problem-solving skills.
• Excellent written and verbal communication skills, including the ability to translate technical security concerns into business risks and actionable recommendations.
• Ability to manage multiple assessments and priorities while working effectively with cross-functional stakeholders.

Preferred Qualifications

• Experience evaluating third‑party security risks through vendor risk management, information security, regulatory compliance, or audit activities.
• Familiarity with GRC and risk management platforms beyond ServiceNow.
• Experience supporting risk registers, control assessments, audit documentation, and remediation plans.
• Relevant certifications such as CISSP, CISM, CISA, or comparable cybersecurity and risk management credentials.

What Success Looks Like

• Timely and accurate completion of cybersecurity and vendor risk assessments.
• Clear documentation of risk findings, control gaps, and mitigation recommendations.
• Effective coordination with business owners and vendors to resolve identified risks.
• Consistent tracking of remediation activities and accurate reporting of the organization’s risk posture.
• Practical, risk‑based recommendations that balance security requirements with business objectives.

Compensation

• $45-55/hr (W2)
• Conversion Salary Target $90,000-100,000

#1329