Cyber Security Analyst III - (Remote -NC, AZ, VA, TX)

First Citizens Bank•Austin, TX

1d•Remote

About The Position

The Cyber Security Analyst III provides cybersecurity risk management and expert support at the highest level of cybersecurity governance and oversight, with primary responsibility for identifying and mitigating cyber risk across the organization. The role evaluates risks, identifies control gaps, and partners with stakeholders to implement mitigation strategies that strengthen the organization’s security posture. It serves as a subject matter expert in risk assessment practices and cybersecurity domains, contributes to broader cyber risk oversight, recommends and monitors process and procedure enhancements, and provides reporting and analysis in support of strategic objectives. The position can be hired remotely in North Carolina, Arizona, Virginia, or Texas. The role leads and supports cybersecurity maturity and risk assessments using industry frameworks, maps control evidence to requirements, evaluates maturity, identifies gaps, recommends actions, and supports remediation planning and tracking. It applies technical cybersecurity knowledge across areas such as identity and access management, network and cloud security, endpoint protection, vulnerability management, and security architecture. The analyst collaborates with business, technology, and control owners; reports trends and emerging risks to leadership; monitors remediation; and keeps assessment methodologies current with changes in standards, threats, and regulatory requirements.

Requirements

Bachelor’s degree and 6 years of experience, or a high school diploma/GED or equivalent and 10 years of experience in Information Security.
Direct experience performing cybersecurity risk assessments, including scoping, evaluation, gap analysis, and reporting.
Strong knowledge of cybersecurity frameworks and assessment methodologies, including the CRI Profile, NIST CSF, NIST SP 800-53, ISO 27001, and FFIEC guidance, with experience applying them in complex, highly regulated organizations.
Demonstrated technical expertise across cybersecurity domains including IAM, security architecture, network and cloud security, endpoint protection, and vulnerability management.
Experience identifying risks, defining remediation strategies, and partnering with stakeholders to reduce risk exposure.
In-depth practical knowledge of internal controls, cybersecurity processes, and risk management methodologies.
Excellent written and oral communication skills, including the ability to influence stakeholders and communicate effectively at multiple levels.
Strong analytical, problem-solving, and project management skills.
Familiarity with cybersecurity risk-related regulatory requirements and expectations, such as FFIEC, OCC, FRB, NYDFS, HIPAA, state law, and other guidance.

Nice To Haves

Direct experience performing CRI Profile assessments, including control mapping, evidence review, maturity evaluation, gap identification, reporting, and remediation tracking.
Professional certifications such as CISSP, CISA, CISM, CRISC, or similar.
7–10 years of experience in cybersecurity risk management or cyber risk oversight, including direct execution of cyber risk assessments.
3 or more years of experience in a large financial institution or similarly regulated environment.
Experience with continuous improvement of risk assessment methodologies and reporting practices.

Responsibilities

Lead and support cybersecurity maturity and risk assessments using frameworks and guidance including the Cyber Risk Institute (CRI) Profile, NIST Cybersecurity Framework (CSF), NIST SP 800-53, ISO 27001, and FFIEC guidance.
Map control evidence to framework requirements, evaluate maturity levels, identify gaps, develop recommendations, and support remediation planning and tracking.
Identify potential risks across operational, technology, and regulatory domains.
Work with stakeholders to define and track remediation plans and facilitate risk mitigation aligned with business objectives and regulatory standards.
Apply industry-standard frameworks to assess and benchmark the organization’s risk posture, conduct gap analyses, interpret requirements, and recommend ways to close compliance or control gaps.
Use technical cybersecurity knowledge to assess risks and validate control implementation, and provide insights on technical risk mitigation strategies.
Collaborate with business, technology, and control owners to communicate assessment results, educate stakeholders on risk management expectations, and promote cybersecurity risk awareness and accountability.
Develop and maintain risk assessment reports and dashboards; communicate trends, patterns, and emerging risks to leadership.
Track remediation progress, escalate overdue actions, and highlight areas requiring additional oversight.
Monitor changes in industry standards, the threat landscape, and regulatory requirements, and incorporate emerging practices into risk assessment methodologies.