Cybersecurity Analyst V - Remote

CSAA Insurance Group, a AAA Insurer•Arizona - Home Teleworkers, AZ

6d•$136,890 - $182,450•Remote

About The Position

CSAA Insurance Group (CSAA IG), a AAA insurer, is one of the leading personal lines property and casualty insurance groups in the United States. Here, every employee shapes our mission. We build innovative, human-centered solutions that help AAA members prevent, prepare for, and recover from life's uncertainties. You will join a collaborative, inclusive culture where your strengths have room to grow and your ideas can drive real impact. Step into a role where you can contribute to our shared success through meaningful work. We are actively hiring for a Cybersecurity Analyst V - Remote Your Role: As a senior cybersecurity risk professional, you will serve as a strategic advisor to business and technology leaders, helping identify, assess, and manage complex cybersecurity and technology risks. You will lead cross-functional risk initiatives, influence security and risk management strategies, and help strengthen the organization's risk posture. This role requires the ability to translate technical risks into clear business impact, provide actionable recommendations, and guide decision-making related to cybersecurity investments, controls, and governance. Operating with a high degree of autonomy, you will build trusted partnerships across the organization and contribute to the continuous evolution of cybersecurity risk management practices.

Requirements

8-10 years of progressive experience in cybersecurity, technology risk management, IT operations, IT audit, governance, compliance, or related technical fields.
Demonstrated experience leading complex analyses or cross-functional initiatives, advising stakeholders on risk and control implications, and delivering major work products with a high degree of autonomy.
Experience applying cybersecurity risk management methodologies, control frameworks, governance models, and supporting tools in an enterprise environment.
Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Information Technology, or a related field; or equivalent practical experience may be considered in place of a bachelor's degree.

Nice To Haves

Recognized domain expertise in cybersecurity risk management, governance, control assessment, risk response, and capability or maturity models.
Thorough knowledge of cybersecurity standards and frameworks such as NIST, ISO 27001, and CIS Controls, with the ability to advise on practical application.
Broad understanding of cybersecurity domains and the technologies they protect, including cloud services, networks and infrastructure, applications, data, identity, databases, protocols, security tools, and emerging technologies.
Understands how security capabilities and controls reduce cybersecurity risk.
Exceptional problem analysis in complex, ambiguous, or novel scenarios.
Identifies systemic issues and broader implications; develops defensible solution paths; and explains cost, benefit, uncertainty, and residual risk.
Exceptional understanding of measurement, probability, statistics, metrics, and quantitative risk concepts, including cyber risk quantification, sufficient to develop or apply models and communicate limitations responsibly.
Identifies and assesses business and technology challenges, performs root cause analysis, recommends risk-informed technology solutions, and drives implementation to support organizational objectives and mitigate risk.
Connects cybersecurity and technology risk to business services, processes, strategic objectives, and industry context.
Considers programmatic and organizational impacts when developing recommendations.
Operates with a high degree of autonomy on complex initiatives, providing direction for high-impact work, leading cross-functional efforts, and mentoring team members while maintaining accountability for quality, timeliness, and outcomes.
Actively shapes our company culture (e.g., supporting employee resource groups, mentoring employees, volunteering, joining cross-functional projects)
Champions our cultural norms (e.g., willing to have cameras when it matters: helping onboard new team members, building relationships, etc.)
Demonstrates a company ownership mindset, thinking beyond boundaries of their own area
Travels as needed for role, including divisional / team meetings and other in-person meetings
Fulfills business needs, which may include investing extra time, helping other teams, etc

Responsibilities

Lead cross-domain cybersecurity and technology risk assessments for complex initiatives, critical business processes, control environments, and emerging technologies, including cloud and artificial intelligence use cases.
Define and improve risk assessment approaches, methodologies, standards, and supporting tools to promote consistent identification, analysis, documentation, and treatment of risk.
Apply qualitative and quantitative analysis, including probability, impact, and scenario-based methods, to clarify exposure, compare response options, and support risk-informed decisions.
Evaluate the design and effectiveness of cybersecurity controls and technologies, identify material gaps or systemic themes, and recommend proportionate mitigation, acceptance, transfer, or avoidance strategies.
Serve as a strategic advisor to technology, cybersecurity, and business partners on risk, governance, control, and operational implications.
Translate complex technical risk into concise business impact, options, trade-offs, and recommendations for leaders and non-technical audiences through briefings, presentations, whitepapers, and position papers.
Lead workshops and team member discussions that establish shared understanding, resolve ambiguity, and drive alignment on risk ownership, treatment decisions, priority, and resource needs.
Integrate risk considerations into the lifecycle of technology projects, capabilities, and business initiatives, translating technical risk into business impact and supporting informed decision-making aligned with organizational objectives.
Lead risk framework, reporting, tooling, capability-building, and maturity improvement efforts that span cybersecurity domains and functions.
Identify trends and interdependencies across risks, controls, technologies, and business operations; communicate implications and recommend program-level improvements.
Mentor analysts and risk professionals, share advanced analytical practices, and strengthen consistent application of cybersecurity risk management methods.
Maintain awareness of emerging threats, evolving technologies, regulatory requirements, and industry trends, using these insights to strengthen and enhance cybersecurity risk advisory capabilities.