Security & Technology Risk Analyst

Job Description

Requirements

• Bachelor degree in Computer Science, Information Security, Risk Management, Engineering, or related field
• 5+ years of professional experience in operational risk management, cybersecurity risk, or technology risk assessment
• Demonstrated experience conducting risk assessments, threat analysis, or vulnerability management
• Experience developing risk metrics, KPIs, or dashboards for executive audiences
• Familiarity with risk management frameworks such as NIST Cybersecurity Framework and ISO 27001
• Proficiency in risk assessment methodologies and qualitative/quantitative analysis
• Knowledge of business continuity and disaster recovery planning principles
• Experience in financial services, fintech, or regulated industries is preferred
• Professional certifications such as CISM, CRISC, or equivalent risk/security certification are preferred

Responsibilities

• Track and validate execution of risk treatment plans, monitoring completion rates, escalating delays, and ensuring residual risk remains within tolerance levels
• Design and maintain quantifiable risk metrics and real-time dashboards for executive decision-making and continuous monitoring against organizational risk appetite thresholds
• Analyze emerging threats and regulatory changes to proactively surface new risks and support strategic initiatives including market expansion and new product launches
• Ensure all security and technology risk management activities adhere to ISO 27001, SOC 2, PCI-DSS, NDPA, NIST, and FAIR frameworks
• Support evaluation of third-party and vendor risks and conduct ongoing risk assessments as part of the vendor management programme
• Communicate risk findings and recommendations in business-relevant terms to stakeholders at all levels including executive leadership
• Conduct comprehensive risk assessments across security and technology domains (cloud, network, infrastructure, product, endpoint, third-party) using NIST Risk Management Framework, FAIR methodology, and qualitative/quantitative analysis methods
• Perform Business Impact Analysis (BIA) on critical systems to determine Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO)
• Administer and maintain the security risk register with current and historical records, ensuring comprehensive documentation for regulatory examinations and audits
• Guide development and documentation of risk treatment plans aligned with enterprise risk appetite, collaborating with Engineering, Legal, DevOps, IT, and Security teams