Security Risk Governance Analyst
Core
Identify, assess, and manage security risk across the third-party ecosystem and internal control environment, turning requirements into repeatable processes.
Role type
Security Risk Governance Analyst (IC)
Builds
Third-party security reviews, compliance audit programs, risk registers, security KPIs/KRIs dashboards, and operational runbooks.
Domain
Financial Technology / Information Security Governance
Deliverable
production ML models | product features | dashboards & analysis | client delivery | infrastructure | physical/clinical work
Required skills
Third-party security reviews, risk assessments, controls testing, compliance frameworks (SOX, SOC 2, PCI DSS, ISO 27001, NIST), vulnerability management, security procedure documentation, stakeholder management for risk closure
Preferred skills
Security certifications (CISA, CRISC, Security+), cloud platform experience (AWS, GitHub, GCP)
Technologies
ConductorOne, SRG risk register, Learning Management System, AWS, GitHub, GCP
Responsibilities
Run end-to-end third-party security reviews including due diligence and evidence collection; Support SOX, PCI DSS, SOC 2, and ISO 27001 audit preparations; Conduct risk assessments, gap analyses, and controls testing; Execute quarterly user access reviews; Define and maintain security KPIs and dashboards; Develop security training content; Create operational runbooks and security baselines; Facilitate Security Architecture Reviews.
Seniority
Mid-level, hands-on IC
