Cyber Security Risk Analyst

UL Solutions • Chicago, IL

23h • $86,400 - $115,100 • Hybrid

About The Position

The Global Cybersecurity Risk Analyst supports the identification, assessment, communication, and management of cybersecurity and information risks across the organization. The role evaluates risks involving business operations, technologies, and third-party relationships to help reduce risk exposure and potential business impact. It assesses cybersecurity practices and applicable legal, regulatory, contractual, and industry requirements, and supports the documentation, tracking, and reporting of risks and issues. The Analyst also helps ensure mitigation actions are implemented to reduce residual risk to acceptable levels.

Requirements

• Bachelor’s or master’s degree in business, Computer Science, Cybersecurity, Information Security, or a related field.
• At least 2 years of experience in cybersecurity, information security, technology risk, or a related risk management role.
• At least 2 years of experience managing risk and compliance matters or supporting applications, managed service provider activities, projects, systems, or third-party relationships requiring risk identification, assessment, remediation, and monitoring.
• Demonstrated understanding of operational, cybersecurity, information security, and technology risks.
• Strong business acumen and ability to assess cybersecurity risks and potential impacts in the context of operational, financial, regulatory, and business objectives.
• Experience evaluating complex third-party risks through vendor risk management, information security, regulatory compliance, or audit activities.
• Hands-on experience using ServiceNow to perform and manage Vendor Risk Assessments.
• Experience working with recognized cybersecurity, risk, and compliance frameworks and methodologies, such as ISO/IEC 27001, COBIT, NIST Cybersecurity Framework, NIST SP 800-series guidance, and FAIR.

Responsibilities

• Support focused cybersecurity and information risk assessments for new and existing technologies, services, business initiatives, and third-party providers.
• Identify and document risk scenarios, including relevant assets, threats, vulnerabilities, controls, likelihood, and potential business impact.
• Communicate risk assessment findings to risk owners, business stakeholders, information governance teams, and cybersecurity teams.
• Provide risk-based guidance to support informed decisions about risk acceptance, mitigation, transfer, or avoidance.
• Identify and recommend appropriate controls and risk treatment activities.
• Identify opportunities to improve the organization’s risk posture and assist in developing remediation and mitigation strategies.
• Assess residual risk after mitigating or compensating controls are implemented.
• Track identified risks, issues, remediation activities, and risk events through closure.
• Support the third-party/vendor risk management lifecycle, including risk assessments, due diligence, control validation, ongoing monitoring, and remediation tracking.
• Support responses to external customer cybersecurity and information security questionnaires.
• Apply applicable legal, regulatory, contractual, and industry requirements when evaluating cybersecurity and third-party risks.
• Support risk reporting and documentation to provide visibility into material risks, issues, and remediation activities.

Benefits

• Eligible for annual bonus compensation with a target payout of 10% of base salary.
• Medical, dental, and vision benefits.
• Wellness benefits, including mental and financial health.
• Retirement savings (401K).
• Paid time off for full-time employees, including 15 vacation days, 12 holiday and personal days, and 72 hours of sick time.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level