Senior Cybersecurity Risk & Governance Analyst

mTrade; Oxford (MS); On-site; USD 110,000 - 160,000; Full time

Job summary

mTrade is seeking a Senior Cybersecurity Risk & Governance Analyst to strengthen our GRC program, manage enterprise risk, and coordinate third-party risk and customer due diligence. You will collaborate with CISO, Legal, Audit, and business teams to bolster regulatory compliance and security governance.

The role offers exposure to cloud security, vendor risk, and executive reporting, with a clear path toward leadership in cybersecurity governance, risk, and compliance.

Qualifications

• Bachelor’s degree in cybersecurity or related field.
• 5+ years in cybersecurity risk management, governance, or related disciplines.
• Experience in regulated industries (finance, fintech, banking, healthcare, insurance).
• Experience performing risk assessments and maintaining risk registers.
• Experience responding to customer security questionnaires and audits.
• Experience reviewing SOC 1 and SOC 2 reports and vendor due diligence.
• Knowledge of frameworks such as NIST CSF, ISO 27001, SOC 2, PCI DSS.

Responsibilities

• Maintain and enhance the organization's cybersecurity governance, risk, and compliance program.
• Conduct cyber risk assessments for systems, processes, cloud services, and initiatives.
• Manage third-party risk and vendor due diligence activities.
• Coordinate customer security questionnaires, risk assessments, and audits.
• Develop cybersecurity metrics, dashboards, and governance reporting.
• Support continuous improvement through automation and AI-enabled tools.

Education

Bachelor's degree

Tools

ServiceNow GRC

Archer

LogicGate

AuditBoard

ProcessUnity

Job description

mTrade is seeking a highly motivated Senior Cybersecurity Risk & Governance Analyst to support and enhance our Information Security Governance, Risk, and Compliance (GRC) program. This role is responsible for helping identify, assess, monitor, and communicate cyber and technology risks across the organization while supporting third-party risk management, customer due diligence activities, audit coordination, and security governance initiatives.

This position reports into the Information Security organization and works closely with the Chief Information Security Officer (CISO), Technology, Compliance, Legal, Internal Audit, and business stakeholders. The successful candidate will contribute to strengthening the organization's cybersecurity posture, operational resilience, regulatory compliance, and customer trust programs.

This role offers significant exposure to cybersecurity governance, risk management, cloud security, third-party risk, customer assurance activities, executive reporting, and industry-standard security frameworks. It provides a growth path into senior cybersecurity governance, risk, compliance, and security leadership roles.

Cybersecurity Governance & Risk Management

• Maintain and enhance the organization's cybersecurity governance, risk, and compliance program.
• Conduct cyber and technology risk assessments for systems, business processes, cloud services, and strategic initiatives.
• Maintain the enterprise risk register, ensuring risks, owners, mitigation plans, and status updates remain current.
• Track key risk indicators (KRIs), emerging cyber threats, and remediation activities.
• Assist technology and business teams with risk identification, treatment planning, and control implementation.
• Support development and maintenance of information security policies, standards, procedures, and governance documentation.
• Assist with cybersecurity risk reporting for executive leadership and governance committees.

Third-Party Risk Management

• Conduct vendor cybersecurity assessments and due diligence reviews for new and existing third-party relationships.
• Evaluate vendor security documentation, including SOC reports, penetration test summaries, security assessments, audit reports, and compliance certifications.
• Assess risks associated with cloud-hosted services, SaaS platforms, and strategic technology providers.
• Track remediation activities resulting from third-party assessments and risk reviews.
• Partner with Procurement, Legal, Compliance, Technology, and business stakeholders throughout the vendor lifecycle.
• Maintain accurate third-party risk records and reporting within the organization's GRC platform.

Customer Security Assurance & Due Diligence

• Coordinate responses to customer security questionnaires, risk assessments, and due diligence requests.
• Support customer audits and security review meetings.
• Collaborate with Information Security, Technology, Privacy, Legal, Compliance, and business teams to gather accurate responses.
• Maintain a centralized repository of approved security, compliance, risk, and privacy responses.
• Support development and maintenance of customer assurance materials, including SOC reports, policy summaries, security overviews, and compliance documentation.
• Identify opportunities to improve response quality, consistency, and efficiency through automation and AI-enabled tools.

Audit, Compliance & Control Assurance

• Support internal and external audits, including SOC examinations and customer audits.
• Coordinate evidence collection, documentation, and stakeholder responses.
• Assist with remediation tracking and validation of audit findings.
• Monitor compliance with internal policies, regulatory requirements, and security frameworks.
• Support control testing, assessment activities, and continuous improvement initiatives.

Metrics, Reporting & Governance

• Develop cybersecurity metrics, dashboards, and executive reporting materials.
• Prepare risk summaries and presentations for management and governance committees.
• Analyze risk trends and provide actionable recommendations to leadership.
• Identify opportunities to enhance governance processes through data analytics, workflow automation, and AI-enabled technologies.
• Support ongoing maturation of the cybersecurity program.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Systems, Information Security, Risk Management, Business, Finance, Accounting, or a related field.
• 5+ years of experience in cybersecurity risk management, IT risk, governance, compliance, internal audit, third-party risk management, operational risk, or related disciplines.
• Experience working within financial services, fintech, banking, regulated technology, healthcare, insurance, or another regulated industry.
• Experience conducting risk assessments and maintaining risk registers.
• Experience responding to customer security questionnaires, due diligence requests, and audit inquiries.
• Experience reviewing SOC 1 and SOC 2 reports, security assessments, and vendor due diligence materials.
• Experience supporting SOC examinations, regulatory assessments, customer audits, or customer security reviews.
• Demonstrated experience applying at least one recognized cybersecurity, risk, or control framework, such as NIST CSF, NIST 800-53, ISO 27001, CIS Controls, SOC 2, FFIEC, or PCI DSS.
• Working familiarity with Microsoft Azure, Microsoft 365, cloud governance, and cloud security concepts.
• Strong understanding of cybersecurity risk management concepts, governance practices, and internal controls.
• Excellent written and verbal communication skills, including the ability to communicate effectively with senior leadership, auditors, regulators, customers, and technical teams.
• Strong analytical, organizational, and problem-solving skills.
• Ability to manage multiple priorities and work independently in a fast-paced environment.

Preferred Qualifications

• Experience with GRC platforms such as ServiceNow GRC, Archer, LogicGate, AuditBoard, ProcessUnity, or similar solutions.
• Experience leveraging AI-enabled technologies, workflow automation, Microsoft Copilot, Microsoft Power Platform, Microsoft Purview, or analytics platforms to improve security and risk processes.
• One or more relevant professional certifications, such as CRISC, CISA, CISM, CISSP, CIA, or CRCM.
• Experience supporting process improvement, risk reporting automation, or executive-level cybersecurity metrics and dashboards.