Hybrid Cyber Resilience and Emerging Tech Risk Analyst

SMBC; Charlotte (NC); Híbrido; USD 90.000 - 120.000; Tempo integral

Benefícios oferecidos por esta vaga

Hybrid work model

Disability accommodations

Resumo da vaga

SMBC’s Americas Division Information Security Office seeks an Emerging Tech, Risk and Threat Analyst Associate to support threat modeling, emerging technology risk analysis, and control mapping across AI, cloud services, APIs, and data integrations.

The role requires documenting assets, attack paths, and residual risks, and translating technical findings for senior stakeholders. Hybrid work is available and candidates should reside within commuting distance.

Qualificações

• 2+ years of experience in cybersecurity, technology risk, information security, operational resilience, audit, application security, architecture, threat intelligence, or a related technology control function.
• Foundational understanding of cybersecurity risk concepts, including threats, vulnerabilities, controls, attack surfaces, compensating controls, and residual risk.
• Working knowledge of threat modeling concepts, secure design principles, SDLC practices, cloud services, APIs, identity and access management, and enterprise technology environments.
• Familiarity with emerging technology risk areas, including AI/LLM systems, automation, data protection, third-party technology platforms, and cloud-based services.
• Ability to analyze technical information, identify risk-relevant patterns, and document findings in a clear, structured, and evidence-based manner.
• Strong written communication skills, including the ability to summarize technical risks for non-technical stakeholders.
• Strong organizational skills with the ability to manage multiple assignments, track open items, and maintain accurate documentation.
• Ability to work effectively in a matrixed environment with technology, cybersecurity, risk, compliance, business, and vendor stakeholders.
• Familiarity with industry frameworks and references such as NIST CSF, NIST SP 800-53, ISO 27001/27002, OWASP Top 10, OWASP LLM Top 10, MITRE ATT&CK, MITRE ATLAS, or similar control/threat frameworks.
• Experience with risk assessment tools, GRC platforms, vulnerability management tools, architecture repositories, diagramming tools, or threat modeling platforms preferred.
• Basic scripting, data analysis, reporting, or workflow automation experience preferred but not required.
• Financial services, regulated industry, consulting, or enterprise technology experience preferred.
• BA/BS in Cybersecurity, Computer Science, Information Systems, Information Technology, Engineering, Business, Risk Management, or equivalent relevant experience.
• Relevant certifications preferred but not required, such as Security+, CySA+, GSEC, GCIH, SSCP, CISA, CRISC, CCSK, cloud fundamentals certifications, or AI/security-focused training.

Responsabilidades

• Support threat modeling and emerging technology risk assessments across applications, platforms, business services, and third-party technology solutions.
• Analyze emerging technology use cases, including AI/LLM-enabled capabilities, automation, cloud services, APIs, data integrations, and security tooling, to identify relevant threat scenarios and risk themes.
• Assist in documenting assets, data flows, trust boundaries, dependencies, threat agents, attack paths, control coverage, and residual risks.
• Support risk analysis for AI and LLM-related scenarios, including prompt injection, data leakage, model misuse, excessive agency, insecure integrations, insecure outputs, and third-party dependency risks.
• Help maintain threat modeling evidence, assessment workpapers, issue documentation, and reporting artifacts in approved program repositories and tools.
• Partner with application, architecture, infrastructure, information security, technology risk, and business stakeholders to collect assessment information and validate findings.
• Support mapping of identified risks and controls to relevant frameworks, standards, and internal control taxonomies, such as NIST, ISO, OWASP, MITRE, and internal cyber resilience/control frameworks.
• Assist in preparing concise reports, summaries, dashboards, and briefing materials that communicate assessment scope, key risks, control observations, open questions, and recommended next actions.
• Track action items, enhancement opportunities, and issue remediation activities identified through threat modeling or emerging technology risk reviews.
• Monitor emerging cybersecurity and technology risk trends, including AI security, adversarial use of automation, cloud security, API abuse, supply chain risk, and sector-relevant threat activity.
• Support process improvement by helping refine templates, playbooks, taxonomies, questionnaires, and repeatable assessment procedures.
• Contribute to cross-functional discussions related to secure adoption of emerging technologies, operational resilience, and risk-informed technology decision-making.
• Maintain awareness of the firm’s important business services, critical systems, technology dependencies, and third-party relationships to support resilience-focused analysis.
• Perform multiple concurrent assignments while maintaining accuracy, traceability, and clear documentation.

Conhecimentos

Cybersecurity

Technology risk

Threat modeling

Communication skills

Documentation

Stakeholder management

Formação

BA/BS in Cybersecurity

Ferramentas

GRC platforms

Threat modeling platforms

Diagramming tools

Vulnerability management tools

Descrição da vaga

SMBC’s Americas Division Information Security Office seeks an Emerging Tech, Risk and Threat Analyst Associate to support threat modeling, emerging technology risk analysis, and control mapping across AI, cloud services, APIs, and data integrations.

The role requires documenting assets, attack paths, and residual risks, and translating technical findings for senior stakeholders. Hybrid work is available and candidates should reside within commuting distance.