Risk Analyst – Cybersecurity

GDH; St. Louis (MO); Remote; USD 94,000 - 101,000; Full time

Job summary

GDH is seeking a senior professional to lead third-party cyber risk assessments across pre-contract and ongoing monitoring. You will perform on-site and virtual assessments, review evidence, and ensure remediation of gaps, while providing peer review and applying NIST/ISO risk frameworks in regulated financial services contexts.

The role requires extensive experience, with emphasis on SOC 2, ISO 27001, SIG, CAIQ, and industry certifications. Travel for on-site evaluations is expected.

Qualifications

• 6+ years in third-party cyber risk assessment or vendor risk management.
• Experience with pre-contract due diligence and ongoing monitoring.
• Ability to review SOC 2, ISO 27001, penetration testing evidence, SIG, and CAIQ.

Responsibilities

• Review supplier cybersecurity controls, policies, and evidence.
• Conduct on-site and virtual third-party security risk assessments.
• Evaluate SOC 2, ISO 27001, penetration testing, SIG, and CAIQ docs.
• Perform pre-contract due diligence and ongoing supplier monitoring.
• Peer review assessment work of other team members.
• Validate remediation of identified security and compliance gaps.
• Apply NIST and ISO cybersecurity frameworks.
• Document findings, remediation requirements, and validation results.
• Support third-party risk activities in regulated environments.
• Travel as needed to conduct on-site assessments.

Skills

Third-party risk assessment

Vendor risk management

On-site and virtual assessments

SOC 2 / ISO 27001 review

NIST / ISO frameworks

Remediation validation

Peer review

Education

CTPRP / CISA / CISSP / CISM / CRISC

Tools

OneTrust

ProcessUnity

Archer

Prevalent

Whistic

ServiceNow IRM

Job description

Role Summary

This senior third-party cyber risk assessment role is responsible for evaluating supplier security controls throughout the pre-contract due diligence and ongoing monitoring lifecycle. The position conducts on-site and virtual assessments, reviews security evidence, and validates remediation of identified control gaps. The role also provides peer review of other assessors’ work and applies recognized cybersecurity and risk management frameworks to support supplier oversight. Experience in financial services, regulated industries, consulting, or managed security environments is highly valued.

This senior third-party cyber risk assessment role is responsible for evaluating supplier security controls throughout the pre-contract due diligence and ongoing monitoring lifecycle. The position conducts on-site and virtual assessments, reviews security evidence, and validates remediation of identified control gaps. The role also provides peer review of other assessors’ work and applies recognized cybersecurity and risk management frameworks to support supplier oversight. Experience in financial services, regulated industries, consulting, or managed security environments is highly valued.

Responsibilities

• Review supplier cybersecurity controls, policies, and supporting evidence.
• Conduct on-site and virtual third-party security risk assessments.
• Evaluate SOC 2, ISO 27001, penetration testing, SIG, and CAIQ documentation.
• Perform pre-contract cybersecurity due diligence and ongoing supplier monitoring.
• Peer review assessment work completed by other assessors.
• Validate that suppliers have remediated identified security and compliance gaps.
• Apply NIST and ISO cybersecurity and risk management frameworks.
• Document assessment findings, remediation requirements, and validation results.
• Support third-party risk management activities in regulated enterprise environments.
• Travel as needed to conduct on-site supplier assessments.

Qualifications

• 6+ years of experience in third-party cyber risk assessment, vendor risk management, or supplier security assurance.
• Experience conducting pre-contract due diligence and ongoing third-party monitoring.
• Demonstrated ability to review SOC 2, ISO 27001, penetration testing evidence, SIG questionnaires, and CAIQ assessments.
• Experience performing both on-site and virtual cybersecurity assessments.
• Peer review and remediation validation experience.
• Working knowledge of NIST and ISO cybersecurity frameworks.
• Experience within a large financial services or other regulated enterprise, such as a bank, insurer, card issuer, or asset manager, is strongly preferred.
• Consulting experience with a Big Four firm or managed security provider is valued, particularly when embedded with an enterprise team.
• Experience with OneTrust, ProcessUnity, Archer, Prevalent, Whistic, or ServiceNow IRM is preferred.
• CTPRP, CISA, CISSP, CISM, or CRISC certification is preferred, along with relevant education, training, certifications, or equivalent practical experience.

Publishing Pay Range

Publishing Pay Range: $68.00 – $73.00 Hourly

This is a fully remote role and can be performed from an approved location.