Cyber Risk Management Analyst

CompQsoft, Inc. • New York, NY

2d • $125,000 - $128,000

About The Position

Drive enterprise cybersecurity risk management by transforming compliance into a strategic advantage. Quantify risks, assess control effectiveness, and ensure alignment with NIST 800-53 and FISMA frameworks. Collaborate with Cybersecurity Engineers and Business Analysts to define compliance guardrails, prioritize remediation, and track key cyber risks. Conduct enterprise-wide risk assessments, audits, and user awareness programs to reduce risk and continuously improve the organization’s security posture.

Requirements

• At least 3 years of experience.
• Expertise in GRC methodologies, third-party risk management (TPRM), and federal compliance, including NIST SP 800-53 and NIST SP 800-37.
• Experience tracking and maintaining Risk Registers, performing Security Impact Analyses, and managing the POA&M lifecycle.
• Ability to develop security awareness content to mitigate human-centric risks.
• One or more of the following certifications: CISA, CRISC, CGEIT, CISSP, Security+, CCSK, or CGRC.
• Experience with GRC platforms such as Archer or ServiceNow; TPRM tools such as OneTrust or Prevalent; awareness platforms such as KnowBe4 or Proofpoint; Power BI; advanced Excel; and JIRA.

Responsibilities

• Lead enterprise-wide risk assessments using GRC methodologies to identify, evaluate, and prioritize risks, translating technical vulnerabilities into business impact for stakeholders.
• Ensure ongoing compliance with federal frameworks, including NIST SP 800-53 and 800-37 (RMF), through periodic audits and Security Impact Analyses for new and existing system interconnections.
• Maintain and manage the enterprise Risk Register, tracking key cyber risks and overseeing the full lifecycle of Plans of Action and Milestones (POA&M), ensuring findings are documented, validated, and remediated within defined SLAs.
• Continuously monitor and report critical cyber risks, using risk dashboards and metrics to provide actionable insights to leadership and maintain enterprise risk posture.
• Design and implement security awareness programs and phishing simulations to reduce social engineering risks and strengthen organizational security culture.
• Collaborate with Cybersecurity Engineers and Business Analysts to define compliance guardrails and prioritize remediation activities based on risk impact.
• Use GRC platforms and tools to generate automated risk metrics, heat maps, and executive-level security posture reports.
• Conduct enterprise-wide audits and user awareness programs to reduce risk and improve the organization’s security posture.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed