Information Security Risk Analyst

Bristol County Savings Bank • Taunton, MA

9h

About The Position

The Information Security Risk Analyst supports the Information Security Officer in carrying out the Bank’s information security risk oversight activities. The role assists with information security risk assessments, control monitoring, access reviews, issue tracking, program documentation, and reporting. Working under the direction of the Information Security Officer, the analyst gathers and organizes information, documents observations, follows up on assigned actions, and escalates unusual, urgent, or time-sensitive matters. This position is intended for an early-career professional developing knowledge of information security risk management in a regulated financial institution.

The role establishes short-range plans aligned with the strategic objectives of Enterprise Risk Management. The position has no supervisory scope. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.

Requirements

• 0–3 years of experience in information security, information technology, technology risk, audit, compliance, or a related area.
• Foundational understanding of cybersecurity principles, information security risk, and internal control concepts.
• Basic understanding of information security principles, risk management, and internal control practices.
• Strong interpersonal skills and the ability to interface professionally and collaboratively with all levels of associates.
• Ability to work in a dynamic environment, handle multiple priorities, and manage workload based on evolving business needs and regulatory expectations.
• Ability to work proactively and identify solutions to business problems while considering known constraints.
• Strong attention to detail and ability to organize information, maintain accurate records, and follow documented procedures.
• Basic proficiency with Microsoft Office, including Word, Excel, Visio, and PowerPoint.
• Willingness to obtain industry certifications such as CompTIA Security+, Certified Information Systems Auditor (CISA), or equivalent.

Nice To Haves

• Bachelor’s degree in information systems, cybersecurity, computer science, risk management, business, or a related field.
• Exposure to banking, financial services, insurance, or another regulated environment.
• Introductory familiarity with CIS Critical Security Controls, FFIEC guidance, and similar frameworks.
• Basic familiarity with access controls, vulnerability management, phishing, risk assessments, control testing, or IT General Controls.
• Relevant coursework or interest in pursuing an entry-level certification, such as CompTIA Security+, ISC2 Certified in Cybersecurity, or an ISACA IT Risk Fundamentals or Cybersecurity Fundamentals Certificate.

Responsibilities

• Assist with maintaining information security policies, standards, procedures, control inventories, and supporting program documentation.
• Help compare information security policies, controls, and processes against the Center for Internet Security (CIS) control framework, Federal Financial Institutions Examination Council (FFIEC) Interagency Guidelines, and industry best practices.
• Support risk assessments across systems, applications, and material changes by gathering information, performing analysis, and documenting relevant risks and controls.
• Assist with evaluating key security controls to determine whether they are implemented correctly, operate as intended, and sufficiently mitigate identified risks.
• Assist in the second-line-of-defense evaluation and monitoring of Information Technology’s internal controls, reporting, processes, and procedures.
• Support periodic user access reviews by preparing access lists, comparing access with provided role information, documenting exceptions, and tracking review completion.
• Assist with monitoring vulnerabilities, configuration changes, system updates, and patch remediation against Bank policies and established timeframes.
• Support security awareness activities by helping maintain materials, schedules, communications, and training completion records.
• Assist with preparing supporting materials and status information for management reporting.
• Perform other duties as assigned by Management.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level
• Education Level: No Education Listed