Senior Cyber GRC & Risk Analyst

SAIC; Oregon; Hybrid; USD 120,000 - 170,000; Full time

Job summary

SAIC is seeking a qualified Cybersecurity Risk Analyst to join our risk management program in Oregon. You will conduct risk assessments, monitor controls, and coordinate with stakeholders to remediate findings in line with NIST, ISO, and SOC frameworks.

Responsibilities include vendor risk, third‑party assessments, continuous monitoring, audits, and governance. You will help maintain evidence and tooling (ServiceNow GRC) and elevate material risks to leadership.

Qualifications

• Bachelor's or Master’s degree with 3–5+ years of info security experience.
• Certifications such as CISA, CISSP, CISM, or Security+.
• Strong understanding of NIST RMF, SP 800‑53/171, ISO/IEC 27001, COBIT.
• Ability to translate risk into business terms and present to leadership.

Responsibilities

• Maintain awareness of cybersecurity trends to inform risk mitigation.
• Assist risk assessments and document remediation closedown.
• Conduct third‑party risk assessments with procurement and legal.
• Perform supply chain risk assessments and maintain dashboards.
• Support operational cyber activities and security control implementations.
• Drive continuous monitoring per NIST SP 800‑39; track KRIs.
• Manage vulnerability findings and coordinate remediation with owners.
• Prepare audit evidence and participate in ISO 27001, SOC audits.
• Recommend updates to policies and procedures; develop guidance.
• Develop and deliver stakeholder training to strengthen risk culture.

Skills

Analytical skills

Communication skills

Strategic thinking

Project management

Education

Bachelor's degree in Information Technology or similar

Master's degree

Experience in lieu of degree

Tools

ServiceNow GRC

GRC tooling

Vulnerability scanning tools

DLP / Endpoint protection tools

Job description

SAIC is seeking a qualified Cybersecurity Risk Analyst to join our risk management program in Oregon. You will conduct risk assessments, monitor controls, and coordinate with stakeholders to remediate findings in line with NIST, ISO, and SOC frameworks.

Responsibilities include vendor risk, third‑party assessments, continuous monitoring, audits, and governance. You will help maintain evidence and tooling (ServiceNow GRC) and elevate material risks to leadership.