Senior Cyber Risk Analyst, hybrid | 1066831

Revel-IT-1; Columbus (OH); Híbrido; USD 90.000 - 140.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Hybrid work arrangement

Descripción de la vacante

Revel IT is seeking a Senior Cyber Risk Analyst to develop, maintain, and execute the Third Party Risk Management (TPRM) program. You will manage risk profiles, coordinate supplier assessments, and generate reports and dashboards for leadership.

The role involves collaboration with Enterprise Security, IT, and Supply Chain teams, adherence to NIST CSF, and a hybrid onsite requirement in Columbus with local travel up to 10%. US citizenship is required.

Formación

• Bachelor's Degree or equivalent knowledge
• 6+ years' TPRM experience in varying support functions
• 6+ years of experience with Vendor Control Assessments, SOC2 and metrics
• In-depth experience with TPRM processes, reporting and metrics
• Knowledge of TPRM components, trends, and best practices
• Proficient with MS Office 365 and learning new technical concepts quickly
• Analytical abilities including process analysis and root cause analysis
• Strong collaboration, negotiation, communication, and organizational skills
• Willing to travel up to 10% to business unit or other locations
• Experience with NIST 800 CSF is a plus

Responsabilidades

• Collaborate with Director of Enterprise Security GRC and Managers to ensure assessment results are addressed
• Execute or support Cyber Assessments and TPRM processes across IT, OT, Cyber, and Service Providers
• Drive implementation roadmaps for Cyber Assessments, Archer, Fortress Control Assessments
• Produce reports, dashboards, and metrics to inform management and stakeholders
• Ensure adherence to Supply Chain processes within Cyber Assessments programs
• Support audit and issues tracking for Cyber Assessments as needed

Conocimientos

TPRM experience

Vendor control assessments

SOC 2 reports

NIST CSF knowledge

Educación

Bachelor's Degree or equivalent

Herramientas

Archer GRC tool

Fortress Control Assessments

Workday integration

ServiceNow integration

Descripción del empleo

• Bachelor's Degree or equivalent work experience
• 6+ years' TPRM experience in varying support functions

Our Goal

Treat our consultants and clients the way we would like others to treat us!

Senior Cyber Risk Analyst

A Senior Cyber Risk Analyst is needed for a contract-to-hire opportunity to develop, maintain, and execute the Cyber Assessments program, also known as Third Party Risk Management (TPRM), and Technology support. Cyber Assessments include Supplier / Vendor Control Assessments using GRC platform and coordinating Supplier assessments such as inherent risk rank and Control assessments to provide transparency into the client's Third Party Risk Profiles. Technology support focuses on our enterprise TPRM application.

The Cyber Assessments Analyst will work collaboratively with numerous teams including NERC CIP Compliance, Pipeline Compliance, Innovation, Supply Chain, IT, Enterprise Security, Internal Audit and the business to educate and inform business partners of Third Party Risk Profiles. This role is responsible for managing and reporting on Third Party Cyber Risks by maintaining risk profiles, tracking supplier issues and exceptions, and using tools to create reports, dashboards and metrics.

Hybrid Role

• HYBRID ROLE - Must report onsite 3 days a week. Candidates must be local in Columbus OH or Merrillville IN areas.
• Must have US citizenship

Additional Responsibilities

• Works closely with the Director of Enterprise Security GRC, the Manager Cyber Assessments, the Manager(s) Cyber Compliance, and others as needed to ensure that all assessment results are addressed and leverages GRC Platform and adoption of the program.
• Perform routine assignments in the Cyber Assessment Analyst job band, under the direction of the Director of Cyber and the Manager Cyber Assessments
• Work closely with the business, OT, IT, and Cyber and Service Providers to perform and/or support TPRM and Cyber Assessment processes
• Assist in driving the implementation of the roadmaps for Cyber Assessments, Archer, and Fortress Control Assessments
• Assist in executing the Cyber Assessment (CA) program, ensuring a methodology is used and communicated relative to when a Cyber Assessment is performed, risks are mitigated, results are communicated, and metrics are produced supporting the program.
• Executes or assists others in executing Cyber assessments supporting the business, Cyber, IT, OT, and the Innovation line of business ensuring Supply Chain processes are adhered to.
• Reviews must meet stated objectives, budget requirements, timeline requirements and reporting/readout requirements
• Supports and strives to be knowledgeable relative to Fortress Control Assessments, contributing to the direction of the product, our leveraging of the tool, and the ongoing business benefit to the client
• Supports and strives to be knowledgeable relative to Archer, contributing to the direction of the product, our leveraging of the tool, and the ongoing business benefit to the client
• Serves as an Archer ambassador across NiSource as to capabilities and expanded adoption
• Assist in audit/issues tracking and resolution for processes related to Cyber Assessments as requested
• Advance the use and adoption of Archer RSA to maintain and manage risk, compliance, and policy monitoring and tracking

Required Knowledge, Skills, and Abilities

• Bachelor's Degree or equivalent work experience that provides knowledge and exposure to fundamental theories, principles, and concepts
• 6+ years' TPRM experience in varying support functions
• 6+ years of experience with Vendor Control Assessments, SOC2 reports and metrics
• In-depth experience with TPRM processes, reporting and metrics
• Knowledge of TPRM components, trends, and best practices.
• Solid skills with computers, operating systems, and software (MS Office 365 suite of products) and ability to learn new technical concepts quickly.
• Analytical abilities, including process analysis and development, problem solving and root cause analysis.
• Teaming skills, collaboration, negotiation, communication, organizational, people management and conflict resolution skills.
• Willing to travel up to 10% to business unit or other locations, as needed.
• Involvement in multiple process improvement initiatives
• Good written and verbal communication
• Demonstrated participation in successful delivery of TPRM projects
• Can work independently in multiple functional domains with minor assistance
• Solid understanding of NIST 800 CSF.
• Client business operations knowledge
• Working knowledge of the gas and electric utility industry; additional experience a plus
• Information Technology Infrastructure Library (ITIL) V4 certification a plus

Preferred Additional Qualifications

• Demonstrated experience in Microsoft Excel and Word
• Demonstrated experience in SharePoint
• Demonstrated experience in Reporting / Analytics
• Experience using Archer GRC tool

Key outcomes for success include

• Client is transforming the Cyber Assessments program, leveraging GRC platform and reducing vendor risk The program must effectively communicate results to management, vendor relationship owners, and supply chain related to Continuous Monitoring.
• Cyber Assessments partners with Supply Chain and Cyber Vulnerability Management to provide Third Party Risk Profiles as part of the Supply Chain vendor onboarding and contract renewal processes
• The GRC system of record as an effective tool for IT, Supply Chain, Cyber Compliance and expands to additional business units.
• Interfaces with key client systems of record (i.e. Workday, Service Now, etc.)
• Analyze vendor risk posture, identify risk items, tracking of exceptions, and other data to assist management in making more informed decisions relative to vendor management
• Help ensure that the client and contracted services are performed to satisfaction
• Positive business perception of Cyber Assessments services through proactive actions

Reference:1066831

Don’t meet every single requirement? Studies have shown that women and people of color are less likely to apply to jobs unless they meet every qualification. At Revel IT, we are dedicated to building a diverse, inclusive, and authentic workplace.

Revel IT is an Equal Opportunity Employer. Revel IT does not discriminate on the basis of race, religion, color, sex, gender identity, sexual orientation, age, non-disqualifying physical or mental disability, national origin, veteran status or any other basis covered by appropriate law. All employment is decided on the basis of qualifications, merit, and business need.