Information Security Risk & Vulnerability Management Analyst

Johnson Financial Group•Racine, WI

About The Position

The Information Security Risk & Vulnerability Management Analyst is an individual contributor responsible for executing cybersecurity risk management, vulnerability management, and control assurance activities across the JFG enterprise. This role supports the identification, assessment, prioritization, and remediation of technology risks and vulnerabilities in alignment with JFG’s risk tolerance, regulatory expectations, and internal control standards. The analyst performs risk analysis, control validation, vulnerability lifecycle management, and remediation coordination to help reduce overall cyber risk exposure. Working under the direction of the Information Security Risk & Resiliency Manager, this position operationalizes cyber risk governance processes, including issues and exceptions management, audit support, control effectiveness validation testing, and risk reporting. The analyst operates across multiple security domains, with a primary focus on cyber risk management and vulnerability management, while supporting resilience and post-incident improvement activities. In collaboration with IT, Enterprise Risk Management, Internal Audit, and business stakeholders, this role translates technical findings into business-aligned risk insights and drives remediation outcomes. This position requires strong analytical capability, cross-functional collaboration, and the ability to communicate risk in both technical and business terms. The role is supported by third-party services and enterprise tools, with occasional off-hours support required. Minimal travel less than 5% is expected.

Requirements

Level 1: 2-5 years' experience
Level 1: Works with some supervision
Level 1: Strong report writing and communication skills.
Level 1: Has strong understanding of Information Security platforms at JFG.
Level 1: Has strong understanding of common Information Security controls and frameworks.
Level 1: Has an intermediate understanding of networking concepts and technologies.
Level 1: Has an intermediate understanding of Windows and Linux environments.
Level 1: Can operate beyond instruction and guidelines where needed.
Level 1: Has a basic understanding of financial services industry and can apply operational analysis to understand and communicate the threat.
Level 1: Can revise existing processes/standards as needed.
Level 2: 5-8 years' experience
Level 2: Works without supervision
Level 2: Expert report writing and communication skills.
Level 2: Strong collaboration skills to work with other IS and IT engineers and business partners to solve problems effectively.
Level 2: Has strong understanding of Information Security platforms at JFG.
Level 2: Has strong understanding of common Information Security controls and frameworks.
Level 2: Has a strong understanding of networking concepts and technologies.
Level 2: Has a strong understanding of Windows and Linux environments
Level 2: Can operate beyond instruction and guidelines where needed.
Level 2: Has strong understanding of both cybersecurity industry and financial services industry allowing them to revise existing processes/standards or establish new processes/standards as needed.
Level 2: Takes complete ownership of all RunBook, support, and process documentation for their service portfolio.
Level 3: 8+ years' experience
Level 3: Works without supervision
Level 3: Capable of guiding the work of others.
Level 3: Expert report writing and communication skills.
Level 3: Can develop operational dashboards.
Level 3: Has expert understanding of Information Security platforms at JFG.
Level 3: Has expert understanding of common Information Security controls and frameworks.
Level 3: Has a strong understanding of networking concept and technologies.
Level 3: Has a strong understanding of Windows and Linux environments
Level 3: Can develop instructions and guidelines where needed.
Level 3: Has expert understanding of cybersecurity industry and strong understanding of financial services industry allowing them to revise existing processes/standards or establish new processes/standards as needed.
Level 3: Able to identify operational capability gaps and establish a roadmap/strategy to address them.

Nice To Haves

Level 1: (Desired) Bachelor’s Degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
Level 1: Cybersecurity Certifications (Preferred): Microsoft AZ-500, GIAC-GCIH/GCIA/GCFE/GMON/GPEN, Security+, CEH, SSCP, JFG InfoSec Platforms
Level 1: Other Experience: Experience with Python and PowerShell scripting languages for automation preferred.
Level 2: (Desired) Bachelor’s Degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
Level 2: Cybersecurity Certifications (Preferred): SANS GIAC Certifications in Digital Forensics (GCFE, GCFA, GCFR, GNFA), Offensive Operations (GCIH, GWAPT, GPEN, GCPN, GXPN), Cyber Defense (GSEC, GCIA, GMON, GDSA, GCDA), Cloud Security (GCLD, GWEB, GCSA, GAIPS, GCAD), and Security Leadership (GSLC, GSTRT, GCIL)
Level 2: CompTIA CySA+, PenTest+, CASP+, SecurityX
Level 2: ISC2 CISSP, CCSP
Level 2: ISACA CISM
Level 2: EC-Council CEH
Level 2: Other Experience: Experience with Python and PowerShell scripting languages for automation preferred.
Level 3: (Desired) Bachelor’s Degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
Level 3: Cybersecurity Certifications (Preferred): SANS GIAC Certifications in Digital Forensics (GCFE, GCFA, GCFR, GNFA), Offensive Operations (GCIH, GWAPT, GPEN, GCPN, GXPN), Cyber Defense (GSEC, GCIA, GMON, GDSA, GCDA), Cloud Security (GCLD, GWEB, GCSA, GAIPS, GCAD), and Security Leadership (GSLC, GSTRT, GCIL)
Level 3: CompTIA CySA+, PenTest+, CASP+, SecurityX
Level 3: ISC2 CISSP, CCSP
Level 3: ISACA CISM
Level 3: EC-Council CEH
Level 3: Other Experience: Strong scripting and automation skills with PowerShell o python for automation preferred.

Responsibilities

Perform cyber risk assessments, control testing, and risk analysis across infrastructure, applications, and business processes
Execute and maintain cyber risk issues and exceptions lifecycle, including identification, documentation, tracking, and remediation validation
Support risk exception and risk acceptance workflows, including preparation of analysis, documentation, and impact summaries
Assist in audit coordination, regulatory support, and control compliance activities, including evidence collection and documentation
Translate technical findings into business-aligned risk insights for reporting and decision-making
Contribute to third-party / supply chain risk assessments, including risk scoring and remediation tracking
Execute enterprise vulnerability scanning, analysis, and reporting across infrastructure, cloud, and applications
Identify and assess configuration weaknesses, security gaps, and exposure risks
Perform risk-based prioritization using severity, exploitability, business impact, and other factors as appropriate
Coordinate with IT and application teams to drive remediation and validate closure evidence
Maintain system-of-record accuracy for vulnerability tracking and reporting
Support application security testing (SCA/SAST/DAST) coordination and findings management
Execute technical control testing and validation activities under defined standards
Collect and maintain audit evidence to support control assurance and audit readiness
Produce operational metrics, dashboards, and reporting to support management decision-making
Assist in mapping controls to frameworks and regulatory requirements (e.g., CIS Controls)
Identify and document control gaps, inconsistencies, and process improvement opportunities
Support post-incident remediation tracking and integration into risk and issues management processes
Assist in gathering inputs for business impact analysis (BIA) and resiliency assessments
Document and track corrective actions, lessons learned, and control improvements from incidents, exercises, and reviews
Partner with IT, ERM, Audit, Vendor Management, and business teams to integrate cyber risk into enterprise processes
Participate in incident follow-up activities to ensure control gaps are addressed
Automate risk, reporting, and vulnerability management workflows using enterprise tools as appropriate
Contribute to continuous improvement of risk and vulnerability management processes, standards, and runbooks
Operate as a cross-functional security analyst supporting GRC, vulnerability management, and technical risk functions
Demonstrate strong business acumen and stakeholder engagement
Communicate effectively with both technical and non-technical audiences
Develop broad, multi-domain security knowledge aligned to modern cybersecurity workforce expectations
Perform other duties as assigned.
Willingly accept new responsibilities to support our success; this includes either taking on new tasks or learning new skills in order to meet business and organizational goals.