Lead Analyst, Information Security (Risk and Governance)

RXO, Inc.•Charlotte, NC

6d•Hybrid

About The Position

As a Lead Analyst, Information Security – Risk Governance you will be responsible for helping strengthen our security and risk management framework. In this role, you'll lead the administration and execution of our information security risk governance program, partnering with business and technology teams to identify, assess, monitor, and mitigate risks that could impact the organization. You'll play a key role in driving risk-informed decision making, enhancing governance processes, and ensuring security risks are managed in alignment with business objectives and regulatory expectations.

Requirements

Bachelor's degree in Cybersecurity, Information Systems, Risk Management, Business, Finance, or a related field, or equivalent combination of education and experience.
6+ years of experience in information security, risk management, governance, compliance, audit, or a related discipline.
Experience managing and facilitating enterprise risk management processes and risk lifecycle activities.
Strong analytical and problem-solving skills with the ability to assess and communicate risk effectively.
Experience partnering with cross-functional stakeholders and influencing decisions in a matrixed environment.
Ability to translate technical concepts into business-focused risk discussions and recommendations.
Strong written, verbal, and presentation skills.
Experience with Microsoft O365 applications.

Nice To Haves

Experience supporting or leading information security risk programs within a large, complex enterprise environment.
Hands-on experience with AuditBoard or a comparable GRC platform.
Knowledge of information security frameworks and standards, such as NIST, ISO 27001, COSO, or similar.
Experience developing executive-level risk reporting, dashboards, and governance metrics.
Familiarity with transportation, logistics, supply chain, or other highly regulated industries.
Relevant certifications such as CRISC, CISA, CISSP, CGRC, or similar.

Responsibilities

Own and manage the end-to-end information security risk lifecycle, including risk identification, assessment, analysis, mitigation planning, acceptance, monitoring, and closure.
Partner with business leaders, technology teams, security engineering, and operational stakeholders to identify and evaluate risks and ensure appropriate risk treatment plans are in place.
Serve as the primary administrator and subject matter expert for AuditBoard, managing risk intake, issue tracking, risk reporting, and governance workflows.
Maintain accurate and thorough documentation of risks, controls, mitigation activities, and exception processes to support audits, regulatory inquiries, and leadership reviews.
Track remediation efforts and validate the effectiveness of corrective actions and risk treatment plans.
Conduct and support periodic risk assessments and control reviews across key risk domains, including cloud security, identity and access management, third-party risk, artificial intelligence, and emerging threats.
Develop dashboards, metrics, executive summaries, and governance reporting to communicate risk posture and trends to senior leadership.
Translate complex technical risks into clear business impacts and recommendations for non-technical stakeholders.
Drive continuous improvement initiatives related to risk governance processes, reporting, and technology platforms.
Ensure alignment with internal policies, industry frameworks, and best practices, including NIST, ISO, COSO, and related standards.
Mentor and provide guidance to junior team members while contributing to the overall maturity of the Governance, Risk, and Compliance (GRC) program.