IT Risk Analyst II

Western Governors University•Salt Lake, UT

1d•Onsite

About The Position

WGU is seeking an IT Risk Analyst II to join its IT Security Risk team. This role focuses on third-party risk management (TPRM) and security risk assessments for vendors, suppliers, internal systems, and projects. The analyst will recommend controls to mitigate risk, requiring a deep understanding of system functionality, vendor operations, and business objectives. This is a senior-level position where you will work independently, use sound judgment in selecting assessment methods, and provide guidance to stakeholders both within and outside the security function.

Requirements

Bachelor's degree in a related field and 3 years of relevant work experience, OR 7+ years of information security experience, OR 6+ years of experience with a relevant certification.
Working knowledge of risk management frameworks and practices, including NIST.
Working knowledge of regulations relevant to higher education and data protection, such as FERPA, GLBA, GDPR, and HIPAA.
Experience assessing security controls and recommending safeguards in a corporate environment.
Experience with cybersecurity and privacy principles used to manage risk to the use, processing, storage, and transmission of data.
Experience with AI tools, including building or using AI agents in day-to-day work.
Strong analytical and problem-solving skills; detail-oriented and results-driven.
Strong written and oral communication skills, including the ability to explain technical risk to non-technical audiences.

Nice To Haves

Industry certification, such as CISSP, CISM, CRISC, or CISA.
Experience with TPRM platforms or GRC tooling.
Higher education experience.

Responsibilities

Conduct end-to-end third-party and supplier risk assessments, including scoping, evidence review (SOC 2 reports, questionnaires, contracts), risk analysis, and determining residual risk.
Perform security risk assessments of internal systems, projects, and applications using industry-accepted frameworks like NIST.
Conduct Open-Source Intelligence (OSINT) research on third parties, suppliers, and applications to assess their security posture.
Collaborate with engineers, architects, and business units to understand system, vendor, or project operations before recommending controls.
Recommend security controls that align with risk and business context, and support implementation teams.
Provide guidance to operational teams and third parties on remediating identified deficiencies.
Work with IT and business unit management to ensure third parties, applications, and suppliers comply with university security requirements.
Serve as lead analyst for risk analysis, third-party risk, and exception-to-policy efforts.
Communicate risk to management in clear terms, outlining the risk, affected parties, and costs of acceptance or remediation.
Measure, collect, and report on key risk indicators and information security services.
Identify and implement AI efficiencies in risk and assessment workflows, including AI-assisted analysis and agent-based tooling.
Contribute to security policies, standards, procedures, and assessment methodologies, identifying and addressing process gaps.
Act as an advocate for information security, educating the business on risk, standards, and best practices for third parties and products.