Security Risk Analyst

CCC Intelligent Solutions•Chicago, IL

1d•$70,139 - $100,000

About The Position

The Security Risk Analyst plays a critical role within the security team, identifying, analyzing, and managing security risks across the organization. The role combines knowledge of security governance processes with technical expertise to assess vulnerabilities and quantify associated risks. The analyst supports business decision-making by delivering quantitative risk assessments and documenting risk acceptance or rejection and mitigation strategies. The role contributes to the security strategy by enabling informed, risk-based decisions that align with governance frameworks while supporting business agility. The analyst also helps maintain and update governance documentation, using knowledge of regulatory requirements such as HIPAA, PCI DSS, SOX, and privacy requirements, as well as security frameworks such as ISO and NIST, to keep policies and standards current and effective.

Requirements

At least 4 years of cybersecurity experience.
Bachelor of Science degree in Computer Science, MIS, or Cybersecurity.
Experience responding to security-related audits or queries from customers or auditors.
Experience assessing and processing risk through a formal risk management process.
Basic understanding of IT technology, including the ISO seven-layer model, TCP/IP, encryption, risk-rating methodology, and security concepts.
Familiarity with regulatory requirements such as PCI, SOX, HIPAA, GDPR, and GLBA.
Working knowledge of security frameworks, including ISO and NIST.
Excellent written and verbal communication skills, including the ability to explain complex security concepts to non-technical audiences.
Solid understanding of incident response, system configuration, vulnerability management, and security hardening practices.
Ability to think critically and work independently without constant detailed instructions.

Nice To Haves

A security-related certification, such as CISSP or CISA.
Certification or coursework related to ITIL or ITSM.

Responsibilities

Conduct enterprise-wide, continuous risk assessments in collaboration with compliance and security teams.
Manage the risk lifecycle, including identification, validation, documentation, and tracking within the GRC platform.
Support internal and external audits, compliance initiatives, and customer queries by providing timely and accurate responses.
Identify and assess risks related to privacy, security, business continuity, and regulatory compliance.
Recommend and document security improvements that balance risk mitigation with operational efficiency and innovation.
Participate in third-party vendor risk assessments to ensure appropriate safeguards are in place.
Analyze risk findings and report on program gaps and areas for improvement.
Define and track qualitative and quantitative metrics to evaluate the effectiveness of the security program.
Maintain and update the library of governance documents, including policies, standards, and guidelines.
Collaborate with security, audit, and risk leadership on ongoing program assessments and strategic planning and budgeting.
Respond to ad-hoc security-related inquiries from employees across the organization.
Design security-related processes and document them in process or procedure documents.
Make continuous service improvements to streamline processes on a regular basis.