Security Risk Analyst

CCC Intelligent Solutions•Chicago, IL

About The Position

The Security Risk Analyst works within CCC’s security team to identify, analyze, and manage security risks across the organization. The role combines knowledge of security governance processes with technical expertise to assess vulnerabilities, quantify risks, and support business decisions through risk assessments and documentation of risk acceptance, rejection, and mitigation strategies. The analyst contributes to the organization’s security strategy by enabling informed, risk-based decisions that align with governance frameworks while supporting business agility. The role also maintains and updates governance documentation, applying knowledge of regulatory requirements such as HIPAA, PCI DSS, SOX, and privacy requirements, as well as security frameworks such as ISO and NIST. The position supports enterprise risk assessments, audit and compliance activities, third-party vendor assessments, security program metrics, governance documentation, and continuous process improvement. It also responds to security-related inquiries from employees, customers, and auditors, and develops documented security processes and procedures.

Requirements

At least 4 years of cybersecurity experience.
Bachelor of Science degree in Computer Science, MIS, or Cybersecurity.
Experience responding to security-related audits or inquiries from customers or auditors.
Experience assessing and processing risk within a formal risk management process.
Basic understanding of IT technology, including the OSI seven-layer model, TCP/IP, encryption, risk-rating methodologies, and security concepts.
Familiarity with regulatory requirements such as PCI, SOX, HIPAA, GDPR, and GLBA.
Working knowledge of security frameworks, including ISO and NIST.
Excellent written and verbal communication skills, including the ability to explain complex security concepts to non-technical audiences.
Solid understanding of incident response, system configuration, vulnerability management, and security hardening practices.
Ability to think critically and work independently without constant detailed instructions.

Nice To Haves

A security-related certification, such as CISSP or CISA.
ITIL or ITSM-related certification or coursework.

Responsibilities

Conduct continuous enterprise-wide risk assessments in collaboration with compliance and security teams.
Manage the risk lifecycle, including identification, validation, documentation, and tracking in the GRC platform.
Support internal and external audits, compliance initiatives, and customer inquiries by providing timely, accurate responses.
Identify and assess risks related to privacy, security, business continuity, and regulatory compliance.
Recommend and document security improvements that balance risk mitigation with operational efficiency and innovation.
Participate in third-party vendor risk assessments to ensure appropriate safeguards are in place.
Analyze risk findings and report program gaps and areas for improvement.
Define and track qualitative and quantitative metrics to evaluate security program effectiveness.
Maintain and update governance documents, including policies, standards, and guidelines.
Collaborate with security, audit, and risk leadership on ongoing program assessments and strategic planning and budgeting.
Respond to ad hoc security-related inquiries from employees across the organization.
Design security-related processes and document them in process or procedure documents.
Make regular continuous service improvements to streamline processes.