Senior IT Security Risk Analyst (REMOTE)

Hanover Insurance Company; Worcester (MA); Remote; USD 100,000 - 130,000; Full time

Job summary

A leading insurance company is seeking a Senior IT Security Risk Analyst to develop and manage security policies. With a focus on risk evaluation and compliance, this full-time remote role offers an opportunity for growth and contribution to a supportive work culture with comprehensive benefits.

Benefits

Medical, dental, vision, life, and disability insurance

401K with a company match

PTO

Cultural Awareness Day in support of IDE

On-site medical/wellness center

Qualifications

• 5-7 years of direct experience in an information security role.
• Expert knowledge of information security systems and procedures.
• Familiarity with FAIR methodology.

Responsibilities

• Lead the development and management of information security policies.
• Evaluate the business risk environment.
• Track remediation of identified control gaps.

Skills

Analytical skills

Problem-solving skills

Communication skills

Leadership

Education

Bachelor's degree in Computer Science or technology/information security-related field

Job description

Senior IT Security Risk Analyst (REMOTE)

Worcester, MA, USA

Job Description

Posted Tuesday, June 10, 2025 at 4:00 AM

For more than 170 years, The Hanover has been committed to delivering on our promises and being there when it matters the most. We live our values every day, demonstrating we CARE through our values, Sustainability initiatives and inclusive corporate culture .

Our IT Security team is looking for a Senior Information Security Risk Analyst to join our team in Worcester, MA, Windsor, CT or remote work location.

This is a full time, exempt role.

POSITION SUMMARY:

The Senior Information Security Risk Analyst will lead the development and management of information security policies, standards and guidelines.

This role is also responsible for working directly with our business partners to evaluate the business risk environment, assessing key control appropriateness and effectiveness, determining information security risk, and providing direction on the development of appropriate security measures to mitigate risk exposure.

In addition, the senior analyst will track remediation of any identified control gaps and deficiencies, analyze data for management reporting and ensure all cyber and data security requirements are in place.

IN THIS ROLE, YOU WILL:

• Develop, implement and maintain a policy management lifecycle process, including develop, implement and communicate security policies, procedures, standards, best practices, guidance and controls.
• Continuously assess existing policies for relevancy and accuracy and work with business partners to identify and manage risks associated with policy violations and exceptions
• Contribute to management’s monthly reporting by analyzing and reporting on IT security controls and risk exposure.
• Responsible for ensuring that all applicable regulatory requirements are addressed, and security controls are managed and maintained.
• Perform information security risk evaluations on reported IT issues and communicate impact of risk to parties involved.
• Participate in IT initiatives, as necessary, to ensure security control measures are addressed and imbedded in business-as-usual activities prior to project completion.
• Experience working with various information security frameworks and standards, cybersecurity regulations and industry compliance requirements.
• Understand the security risk landscape and proactively identify the need for changes to existing controls to meet and exceed industry standards.
• Responsible for building and operating our security risk management processes: risk assessment design and execution, risk treatment, issue and action management portfolio oversight, insight analysis, and reporting
• Advise and collaborate with SMEs, including Audit & Compliance, teams to ensure design and testing of security controls are aligned with leading best practices and executed effectively to manage risk
• Develop and maintain (Key Performance Indicators - KPIs) and risk (Key Risk Indicators - KRIs) metrics for use and reporting by business areas.

WHAT YOU NEED TO APPLY:

• A Bachelor's degree in Computer Science or technology/information security-related field.
• Five to seven (5-7) years’ direct experience in an information security role where risk-based methodology is used.
• Expert knowledge of information security systems and procedures, strong analytical and problem-solving skills, excellent communication skills, expertise in computer networks.
• Familiarity with FAIR methodology
• Certified Information Systems Security Professional (CISSP) is a plus.
• Certified in Risk and Information Systems Controls (CRISC) or equivalent.
• Strong understanding of ISO-27000 based security program functional areas and other commonly accepted standards (e.g. NIST)
• Strong understanding of policy, compliance, and best practice security principles.
• Able to work independently with minimal guidance and act as coach to other team members as necessary.
• Experience leading through influence
• Communication experience, interpersonal experience, and experience working cross-functionally with various teams

CAREER DEVELOPMENT:

It’s not just a job, it’s a career, and we are here to support you every step of the way. We want you to be successful and fulfilled. Through on-the-job experiences, personalized coaching and our robust learning and development programs, we encourage you – at every level – to grow and develop.

BENEFITS:

We offer comprehensive benefits to help you be healthy, build financial security, and balance work and home life. At The Hanover, you’ll enjoy what you do and have the support you need to succeed.

Benefits include:

• Medical, dental, vision, life, and disability insurance
• 401K with a company match
• PTO
• Cultural Awareness Day in support of IDE
• On-site medical/wellness center (Worcester only)

The Hanover values diversity in the workplace and among our customers. The company provides equal opportunity for employment and promotion to all qualified employees and applicants on the basis of experience, training, education, and ability to do the available work without regard to race, religion, color, age, sex/gender, sexual orientation, national origin, gender identity, disability, marital status, veteran status, genetic information, ancestry or any other status protected by law.

Furthermore, The Hanover Insurance Group is committed to providing an equal opportunity workplace that is free of discrimination and harassment based on national origin, race, color, religion, gender, ancestry, age, sexual orientation, gender identity, disability, marital status, veteran status, genetic information or any other status protected by law.”

As an equal opportunity employer, Hanover does not discriminate against qualified individuals with disabilities. Individuals with disabilities who wish to request a reasonable accommodation to participate in the job application or interview process, or to perform essential job functions, should contact us at: [e-mail] and include the link of the job posting in which you are interested.

Privacy Policy:

To view our privacy policy and online privacy statement, click here .

Applicants who are California residents:To see the types of information we may collect from applicants and employees and how we use it, please click here .