Security Risk Analyst

Xcel Energy•Minneapolis, MN

1d•$73,700 - $104,633•Onsite

About The Position

Executes critical aspects of the Enterprise Security Risk Management function. Partners with the business to document and measure risk inherent to systems, assets, and information. Works with the security teams and collaborates with the business to assess IT risks. Tracks risk remediation items. Oversees the risk review process and reporting across the enterprise.

Requirements

Minimum of 3 years experience working in a security function. (One year of working in a highly regulated environment e.g. Utilities, Financial, may substitute for up to 18 months experience in a security function.)
2 years of experience with risk assessments, audit or control testing.
Knowledge of security and lifecycle management, including auditing methodology or technology risk assessments.
Self-starter; adaptable to change; motivated to set personal and program goals and proactively track performance against goals and initiatives.
Ability to develop strong working relationships with peers and stakeholders across business units.
Experience working with information security policies, standards, industry best practices and/or frameworks (e.g., ISO 27K, NIST 800-53, FISMA, BITS, etc.)
Knowledge of IT Security tools and technologies used in an enterprise environment.

Nice To Haves

Bachelor's degree or higher with a concentration in computer science, technology, or business, or equivalent combination of education and experience.
Security or Risk-related certifications (CRISC, CISSP, CISA, etc.)
Experience conducting vendor and project-based security risk assessments, including identifying risks, evaluating impact/likelihood, and recommending appropriate controls and treatment strategies.
Working knowledge of security frameworks and standards (e.g., NIST, ISO 27001) and ability to apply control requirements within risk assessments and findings.
Familiarity with GRC platforms such as Archer and/or ProcessUnity for documenting assessments, tracking risks, and managing findings lifecycle.
Experience developing detailed findings, managing remediation tracking, and supporting risk acceptance and exception processes with minimal guidance.
Ability to partner with business and technology teams to gather requirements, facilitate discussions, and support risk-based decision-making.
Strong written communication skills with the ability to clearly document risk assessments, findings, and recommendations for both technical and business audiences.
Demonstrated ability to work independently, manage ambiguity, and prioritize work across multiple assessments and initiatives.
~5+ years of experience in cybersecurity, IT risk, GRC, audit, compliance, or security consulting.

Responsibilities

Oversees the risk acceptance process across the enterprise to ensure risks are documented and accepted at the correct levels of the organization.
Validates remediation plans are in place to reduce risk where possible.
Manages cycle to reassess accepted risks, obtain sign-off, and provide reporting.
Assists business partners with completing risk assessments and ensuring the correct documentation is captured to support the risk assessment process.
Translates technical language into business terms to facilitate understanding of risk to the business.
Maintains documentation and templates in the GRC toolset and makes recommendations for and implements tool and process improvements.
Collaborates with senior and lead risk analysts on activities related to risk modeling, comprehensive periodic risk assessments, and regulatory reporting standards and expectations, and the development of communication and presentations for internal and external audiences.
Supports on the development of communications and presentations appropriate for senior level audiences and external regulators.