Remote-First Senior IT Risk & Security Analyst

Symetra; Bellevue (WA); Hybrid; USD 80,000 - 133,000; Full time

Benefits offered by this job

Flexible work

401(k) plan

Paid time off

Company matching

Job summary

Symetra is seeking a Senior IT Risk and Security Analyst to bridge IT, Audit Services, and business units, guiding risk assessments, controls, and remediation across the enterprise.

You will lead risk management activities, assess third-party risk, review SOC/ISO 27001, document findings, and partner with Procurement, Legal, and security teams. The role requires strong communication and experience with ITGCs, governance, and audit lifecycles.

Qualifications

• Bachelor’s degree in information systems, Cybersecurity, Computer Science, Accounting, Business, or related field, or equivalent combination of education and experience.
• 5-8 years of experience in IT risk management, information security, IT audit, cybersecurity governance, compliance, or related disciplines.
• Professional certifications such as CISA, CISSP, CRISC, CISM, CIA, ISO 27001 Lead Implementer/Auditor, or other relevant credentials.

Responsibilities

• Lead enterprise IT risk management activities, including annual risk assessments, risk committee facilitation, risk reporting, policy development, risk register management, and continuous improvement of the organization's risk management framework.
• Support third-party technology risk management across the vendor lifecycle, including risk tiering, pre-contract due diligence, security assessments, and periodic monitoring.
• Evaluate SOC reports, ISO 27001 certifications, security questionnaires, penetration tests, external security ratings, encryption and data-handling practices, AI usage, contractual controls, and business continuity capabilities; document risk ratings and findings, drive remediation, and escalate unresolved risks.
• Manage and enhance IT audit and compliance programs, including SOX IT General Controls (ITGCs), ISO 27001 security controls, regulatory requirements, and internal/external audit activities to ensure controls are designed and operating effectively.
• Partner with control owners, auditors, and business stakeholders to track audit findings, drive remediation efforts, provide training, and ensure sustainable compliance across technology and business functions.

Skills

IT risk mgmt

Information security

Audit methodologies

Compliance frameworks

Internal controls

Vendor risk mgmt

SOX ITGCs

ISO 27001

Security governance

Audit lifecycle

Education

Bachelor’s degree in information systems

Job description

Symetra is seeking a Senior IT Risk and Security Analyst to bridge IT, Audit Services, and business units, guiding risk assessments, controls, and remediation across the enterprise.

You will lead risk management activities, assess third-party risk, review SOC/ISO 27001, document findings, and partner with Procurement, Legal, and security teams. The role requires strong communication and experience with ITGCs, governance, and audit lifecycles.