Remote Senior Information Security Risk Analyst

BCD Travel; United States; Remote; USD 110,000 - 150,000; Full time

Benefits offered by this job

Flexible working hours

Remote opportunities

Travel industry perks and discounts

Job summary

BCD Travel seeks a Senior Risk Analyst to manage enterprise information security risk across services, apps, cloud, and third-party suppliers. You will apply structured methodologies, maintain risk registers, and work with owners to implement remediation plans. Strong governance and communication skills are essential.

Ideal candidates have certifications (CRISC/CISSP/CISM), familiarity with ISO/NIST frameworks, and a proactive, independent mindset for a global environment.

Qualifications

• Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Risk Management, Business, or related field, or equivalent experience
• Demonstrated experience conducting information security or technology risk assessments using structured risk management methodologies
• Strong understanding of information security risk concepts, including threats, vulnerabilities, business impact, control effectiveness, and residual risk
• Proven ability to identify control gaps, evaluate controls, and develop practical risk treatment recommendations
• Familiarity with ISO/IEC 27001, ISO/IEC 27002, ISO 31000, NIST CSF, or equivalent frameworks
• Experience assessing risks across applications, cloud services, infrastructure, third-party suppliers, data protection, vulnerability management, and operational security
• Experience reviewing assurance documentation such as ISO certifications, SOC reports, PCI DSS documentation, penetration test results, and supplier security questionnaires
• Experience maintaining risk registers and producing audit-ready documentation
• Ability to facilitate risk discussions and translate complex issues into business risks
• Knowledge of emerging technology risks including AI, privacy, and regulatory requirements
• Certifications such as CRISC, CISSP, CISM, or ISO/IEC 27001 Lead Auditor/Implementer
• Governance-first mindset with analytical skills and independent work capability

Responsibilities

• Lead information security risk assessments across applications, infrastructure, cloud services, processes, projects, and third-party suppliers
• Determine inherent and residual risk ratings with documented evidence and clear rationale
• Identify control gaps and evaluate design, implementation, and effectiveness of security controls
• Develop risk statements and practical treatment options addressing business and security needs
• Map risks to internal policies, controls, and regulatory requirements
• Collaborate with owners to develop remediation plans with actions, deadlines, and ownership
• Maintain and improve the centralized risk register and evidence
• Assess risks for third-party suppliers including assurance documents and tests
• Evaluate risks from emerging technologies, including AI, and provide governance guidance
• Collaborate across Security, Privacy, Legal, Compliance, Audit, Tech, Procurement, and stakeholders
• Prepare risk dashboards, metrics, and management reports highlighting exposures and progress
• Monitor changes in technology, processes, and regulatory requirements and trigger reassessments

Skills

Risk assessment

Governance

Stakeholder management

Communication

Information security

Education

Bachelor's degree or equivalent experience in information security

Relevant certifications (CRISC, CISSP, CISM)

Tools

ISO/IEC 27001

NIST CSF

SOC reports

Job description

BCD Travel seeks a Senior Risk Analyst to manage enterprise information security risk across services, apps, cloud, and third-party suppliers. You will apply structured methodologies, maintain risk registers, and work with owners to implement remediation plans. Strong governance and communication skills are essential.

Ideal candidates have certifications (CRISC/CISSP/CISM), familiarity with ISO/NIST frameworks, and a proactive, independent mindset for a global environment.