Cybersecurity Risk Analyst

Gulf Coast Automation Group•Northbrook, IL

3d•Hybrid

About The Position

TalentFish is hiring a Cybersecurity Risk Analyst to support cybersecurity risk assessments across technologies, business initiatives, and third-party providers. This is a hybrid, contract-to-hire W2 role based in Northbrook, Illinois, with three days per week in the office. The work is divided approximately equally between vendor/third-party risk and internal risk assessments, with an initial focus on coordinating vendor assessments with existing contractors. The analyst is expected to manage assessments independently from intake through recommendations and remediation support, communicate business risk clearly, and handle competing priorities with minimal supervision. A laptop, monitors, and headset will be provided. The role includes assessing and documenting risk scenarios, evaluating control design and implementation, recommending risk treatment, evaluating residual risk, and tracking remediation through closure. The analyst will also support exception management, third-party due diligence and monitoring, external customer security questionnaire responses, and risk reporting. The expected pay range is $40–$56 per hour, depending on experience and qualifications. The position requires authorization to work in the U.S. without current or future visa sponsorship, and offers are contingent on a background check.

Requirements

Bachelor's or master's degree in Business, Computer Science, Cybersecurity, Information Security, or a related field.
At least 4 years of relevant cybersecurity, information security, technology risk, or risk management experience.
At least 2 years managing risk and compliance matters or supporting technologies, services, projects, systems, or third-party relationships involving risk identification, assessment, remediation, and monitoring; this experience may overlap with the 4-year requirement.
Ability to independently conduct cybersecurity risk assessments with minimal supervision, including identifying risks, evaluating controls, documenting conclusions, and recommending risk treatment.
Hands-on understanding of vendor/third-party and internal risk assessment processes, including managing the assessment lifecycle from intake through remediation follow-up.
Experience applying FAIR and NIST risk assessment methodologies, including quantitative and qualitative approaches.
Ability to evaluate control design and implementation and assess inherent and residual risk.
Ability to translate technical security concerns into clear business risk statements and communicate findings to business and risk owners.
Experience documenting risks and findings, maintaining risk registers, and tracking remediation with stakeholders.
Strong analytical judgment, organization, and follow-through, including the ability to manage high assessment volume and competing priorities in a fast-moving environment.
Authorization to work in the U.S. without current or future visa sponsorship.

Nice To Haves

Hands-on ServiceNow experience managing vendor risk assessments and risk workflows is strongly preferred.
An experienced risk analyst with strong assessment process knowledge may be considered without ServiceNow if able to learn the platform quickly with minimal assistance.
Familiarity with ISO/IEC 27001, COBIT, the NIST Cybersecurity Framework, and NIST SP 800-series.
CISSP, CISM, or CISA certification; certifications are not required.

Responsibilities

Independently conduct and manage cybersecurity and information risk assessments for technologies, services, business initiatives, and third-party providers.
Divide work approximately equally between vendor/third-party risk and internal assessments, initially prioritizing vendor assessments and coordinating existing contractors.
Manage assessments from intake through analysis, recommendations, stakeholder communication, and remediation support.
Identify and document risk scenarios, including assets, threats, vulnerabilities, controls, likelihood, and business impact.
Develop clear risk statements and distinguish risks from issues, findings, and control deficiencies in the risk register.
Evaluate controls, recommend risk treatment, and assess residual risk after mitigating or compensating controls are implemented.
Track risks, findings, and remediation activities through closure, following up consistently with stakeholders.
Support exception management requests and coordinate with relevant stakeholders.
Support third-party due diligence, control validation, ongoing monitoring, and remediation tracking.
Communicate assessment results promptly and provide reporting on material risks and outstanding remediation.
Support responses to external customer security questionnaires and apply relevant legal, regulatory, contractual, and industry requirements when evaluating risks.