Cybersecurity Risk Analyst

National University•Remote, California, CA

5d•$62,579 - $84,480•Remote

About The Position

As a member of the Information Security team, the Cyber Risk Analyst assists in enhancing our information security, information governance, privacy, compliance, and risk management procedures. This role will report to the Director, Information Security and closely collaborate with Technology Solutions, Product Management, Legal, and other colleagues to identify flaws and vulnerabilities in university and vendor systems to proactively develop solutions that mitigate risk. This role will support compliance efforts aligned with federal cybersecurity requirements, including NIST SP 800-171 and the Cybersecurity Maturity Model Certification (CMMC), where applicable.

Requirements

Bachelor´s degree in a related field preferred.
Minimum of three (3) years of experience in governance, risk, and compliance and/or information security or audit required.
Experience with third-party GRC and vendor management platforms preferred.
Advanced knowledge and understanding of NIST Cybersecurity Framework and NIST SP 800-53 controls preferred.
Prior knowledge of NIST Special Publications 800-53 and 800-171 and familiarity with Cybersecurity Maturity Model Certification (CMMC) is preferred.
Experience supporting regulated environments or compliance frameworks (e.g., CMMC, federal contracts, or CUI handling requirements) is a plus
Experience in higher education preferred.
Experience working in a technology-driven enterprise preferred.
Advanced knowledge and understanding of NIST Cybersecurity Framework and NIST SP 800-53 controls.
Expertise in complex business processes and technological risks.
Ability to apply critical thinking skills and a high attention to details to identify appropriate resolutions.
Self-starter that possesses a strong desire to seek optimal solutions and share discovery with colleagues.
Advanced written and verbal communication skills.
Ability to participate as an active team member of the Business Unit, Department, and University to work toward a common goal.
Deep understanding of security technologies including firewalls, proxies, SIEM, IDPs, and antivirus software.
Advanced understanding of third-party risk management.
Knowledge of penetration testing, network security, and common techniques to expose and correct security flaws.
Working knowledge of compliance frameworks and control mapping across NIST CSF, NIST SP 800-171, and CMMC domains.
Actively seeks opportunities to influence, build effective relationships and gain alignment with peers, functional partners and/or external partners to accomplish business objectives.
Accepts personal accountability, proactively seeks resolution for personal limitations head-on; and supports honesty and respect towards others, the company and oneself.
Develops new insights into situations; questions conventional approaches; encourages new ideas and innovations; designs and implements new or cutting-edge programs and processes. Ability to generate and/or recognize imaginative or creative solutions that generate successful outcomes.
Strong interpersonal skills and the ability to effectively communicate with a wide range of individuals of constituencies in a diverse community. Ability to communicate well orally and in writing. Ability to develop and use empathetic listening skills, communicate with clarity, and maintain an attitude that conveys respect, assistance, honesty, and resourcefulness.

Nice To Haves

Experience with third-party GRC and vendor management platforms
Advanced knowledge and understanding of NIST Cybersecurity Framework and NIST SP 800-53 controls
Prior knowledge of NIST Special Publications 800-53 and 800-171 and familiarity with Cybersecurity Maturity Model Certification (CMMC)
Experience supporting regulated environments or compliance frameworks (e.g., CMMC, federal contracts, or CUI handling requirements)
Experience in higher education
Experience working in a technology-driven enterprise

Responsibilities

Collaborates with university business and academic leaders to identify and enhance existing control processes.
Identifies and enhances existing control processes with university business and academic leaders.
Improves internal control.
Evaluates the effectiveness of existing security controls and recommends enhancements to mitigate identified risks.
Administers audit and security governance, risk, and compliance (GRC) tools, to document, maintain, and enhance controls.
Administers third party risk management tools.
Maintains knowledge of key NIST controls and enhances IT controls and policies accordingly.
Manages and maintains the controls of the IT audit program.
Prepares team members and necessary materials for audit meetings (e.g., control design walkthroughs), follow-up requests, and testing.
Builds testing and validation of IT General Control (ITGC) processes for internal audit.
Reviews auditor requests to ensure they are appropriately scoped and reasonable and reviews the completeness and accuracy of audit evidence and materials provided by internal team members prior to auditor submission.
Partners with senior leaders to ensure team member accountability for completing audit assignments on time with the appropriate level of priority, thoroughness, and accuracy, according to documented procedures.
Identifies and ranks the inventory of third parties that pose a risk to the university.
Supports the implementation and ongoing maintenance of controls aligned with CMMC and NIST SP 800-171 requirements.
Assists in preparing for and supporting CMMC readiness assessments and external audits, including documentation, evidence collection, and gap remediation tracking.
Collaborates with internal stakeholders and third-party vendors to ensure alignment with federal data protection requirements (e.g., Controlled Unclassified Information - CUI) where applicable.
Contributes to the development and operationalization of CMMC aligned policies, standards, and procedures within the university’s information security program.
Identifies and ranks the inventory of third parties that pose a risk to the university.
Collects the necessary security and auditing information from third parties, analyzes, and recommends its implementation as a control.
Manages the maturation of the third-party risk management program through the development of standard operating procedures.
Subject matter expert (SME) for security needs and ensures best practices are effectively communicated and implemented.
Provides an exceptional level of customer service and support to all business units and other internal and external contacts and responds in a timely manner to customer service feedback.
Stays updated on changes in cybersecurity regulations and adjusts risk management strategies accordingly.
Ensures compliance with relevant cybersecurity regulations, standards, and best practices.
Performs other duties as assigned.