Senior Cyber Risk Analyst (Remote)

Xerox Corporation; Northern (KY); Hybrid; USD 146,000 - 195,000; Full time

Job summary

Xerox Holdings Corporation is seeking a Sr. Risk Analyst to support and lead cybersecurity risk initiatives within our GRC organization. You will assess, monitor, and report on cybersecurity and third-party risk using CIS Controls and the NIST CSF.

The role focuses on Third-Party Risk Management, CMMC and FedRAMP compliance, risk register management, and executive-level reporting. Remote work within the United States is supported.

Qualifications

• Bachelor’s degree in a related field or equivalent practical experience.
• 5+ years of information security, IT risk management, audit, or compliance experience.
• Experience leading or mentoring analysts or project teams.
• Strong knowledge of CIS Critical Security Controls and the NIST Cybersecurity Framework.
• Experience with third-party/vendor risk management programs and due diligence.

Responsibilities

• Lead and perform cybersecurity risk assessments using CIS Controls and the NIST CSF.
• Mature Third-Party Risk Management processes, including vendor questionnaires and ongoing monitoring.
• Review SOC 2 reports, security questionnaires, certifications, and due diligence materials.
• Support CMMC compliance efforts, including SSPs and readiness assessments.
• Advise on FedRAMP authorization and continuous monitoring for cloud services.
• Maintain risk registers, dashboards, and executive risk reporting.

Skills

Cybersecurity

Risk management

Leadership

Communication

NIST CSF

CMMC knowledge

Education

Bachelor’s degree in Cybersecurity

Tools

ServiceNow GRC

OneTrust

Job description

Xerox Holdings Corporation is seeking a Sr. Risk Analyst to support and lead cybersecurity risk initiatives within our GRC organization. You will assess, monitor, and report on cybersecurity and third-party risk using CIS Controls and the NIST CSF.

The role focuses on Third-Party Risk Management, CMMC and FedRAMP compliance, risk register management, and executive-level reporting. Remote work within the United States is supported.