Senior IT Risk & Security Analyst - Remote

symetraexternal; United States; Hybrid; USD 80,000 - 133,000; Full time

Benefits offered by this job

Flexible hybrid work

401(k) plan with company match

Paid time off + holidays

Company matching charitable giving

Job summary

Symetra Investment Management SIM is seeking a Senior IT Risk and Security Analyst to join the ISO team. This role partners IT, audit services, and business to manage IT risk, improve controls, and coordinate remediation across stakeholders.

You will lead risk assessments, vendor risk, and audit programs, while developing executive dashboards and ensuring regulatory compliance. Remote-friendly, hybrid work options supported in the US.

Qualifications

• You’re an analytical problem solver with a strong understanding of information security, IT risk management, audit methodologies, compliance frameworks, and internal controls.
• You have experience managing complex risk assessments, audit programs, and compliance initiatives, with the ability to translate technical risks into business-focused recommendations.
• You’re an effective communicator who can confidently collaborate with executives, auditors, IT leaders, business stakeholders, and external vendors to influence positive outcomes.

Responsibilities

• Serve as a trusted advisor to IT and business teams by identifying technology, security, and operational risks, recommending effective controls, and ensuring risks are properly assessed, documented, and mitigated.
• Lead enterprise IT risk management activities, including annual risk assessments, risk committee facilitation, risk reporting, policy development, risk register management, and continuous improvement of the organization's risk management framework.
• Support third-party technology risk management across the vendor lifecycle, including risk tiering, pre-contract due diligence, security assessments, and periodic monitoring. Evaluate SOC reports, ISO 27001 certifications, security questionnaires, penetration tests, external security ratings, encryption and data-handling practices, AI usage, contractual controls, and business continuity capabilities; document risk ratings and findings, drive remediation, and elevate unresolved risks in partnership with Procurement, Legal, business owners, and security teams.
• Manage and enhance IT audit and compliance programs, including SOX IT General Controls (ITGCs), ISO 27001 security controls, regulatory requirements, and internal/external audit activities to ensure controls are designed and operating effectively.
• Partner with control owners, auditors, and business stakeholders to track audit findings, drive remediation efforts, provide training, and ensure sustainable compliance across technology and business functions.
• Evaluate third-party vendors, emerging technologies, and business initiatives to identify security and operational risks, implement monitoring controls, and support disaster recovery and business continuity planning efforts.
• Develop executive-level reporting and dashboards that communicate risk exposure, audit results, compliance status, and remediation progress to senior leadership and governance committees.
• Conduct reviews of information systems, business applications, infrastructure, and operational processes to assess security posture, control effectiveness, and alignment with company objectives.
• Maintain ownership of risk management tools and processes, ensuring accurate documentation, reporting, workflow management, and ongoing program maturity.

Skills

Information security

IT risk management

Audit methodologies

Compliance frameworks

Internal controls

Education

Bachelor’s degree in information systems, Cybersecurity, Computer Science, Accounting, Business, or related field

Tools

SOX ITGCs

ISO 27001 controls

Job description

Symetra Investment Management SIM is seeking a Senior IT Risk and Security Analyst to join the ISO team. This role partners IT, audit services, and business to manage IT risk, improve controls, and coordinate remediation across stakeholders.

You will lead risk assessments, vendor risk, and audit programs, while developing executive dashboards and ensuring regulatory compliance. Remote-friendly, hybrid work options supported in the US.