Sr Risk Analyst

Informa Group .•Newton, MA

2d•Hybrid

About The Position

Informa TechTarget is seeking an experienced and strategic Senior Cyber Risk Analyst to manage cybersecurity risk across the organization. Based in the Newton, Massachusetts office, the role leads enterprise risk assessments, identifies and evaluates threats and vulnerabilities, develops mitigation plans, and reports on the organization's cyber risk posture to executive leadership and other stakeholders. The analyst partners with engineering, IT, security, product, legal, compliance, privacy, and internal audit teams on strategic initiatives and technology implementations. The position covers cloud and hybrid infrastructure risk, vulnerability and threat management, third-party and vendor risk, cybersecurity governance and compliance, executive reporting, and emerging technology risks. It also includes supporting AI governance and assessing security, privacy, model, and ethical risks associated with AI/ML systems. The role uses established risk frameworks and translates technical cybersecurity issues into business-focused risk information and recommendations.

Requirements

Bachelor's degree in Cybersecurity, Information Security, Risk Management, Computer Science, Information Technology, or a related field.
5–8 years of progressive experience in cybersecurity risk management, information security, or IT risk.
A proven track record conducting enterprise-level cyber risk assessments in complex technology environments.
Experience assessing cloud security risks and working with AWS, Azure, or GCP.
Demonstrated experience in third-party risk management and vendor security assessments.
At least one required certification: CRISC, CISSP, or CISM.
Deep understanding of cybersecurity principles, threats, vulnerabilities, and attack vectors.
Strong knowledge of risk management frameworks, including NIST, ISO 27001, SOC 2, and SOX.
Experience with vulnerability management tools and processes.
Knowledge of cloud security architecture and controls, security controls, defense-in-depth strategies, and compensating controls.
Familiarity with compliance frameworks such as SOC 2, ISO 27001, and NIST 800-53.
Experience with GRC platforms and understanding of network, application, and infrastructure security.
Exceptional analytical and critical-thinking skills, attention to detail, and written and verbal communication skills.
Ability to translate technical cybersecurity concepts into business risk language and influence stakeholders across organizational levels.
Proficiency with data analysis and visualization tools, project management capabilities, and ability to manage multiple priorities.

Nice To Haves

CISA, CGRC, CCSP, or other relevant cybersecurity or risk management certifications.
Master's degree in Cybersecurity, Information Security, Risk Management, or a related field.
Background in information security operations or security engineering.
Knowledge of security architecture and secure design principles.
Experience with security incident response and business continuity planning.
Familiarity with AI/ML security risks and emerging technology governance.
Understanding of privacy regulations such as GDPR, CCPA, and PIPEDA.

Responsibilities

Lead enterprise-wide cyber risk assessments across business operations, systems, and infrastructure.
Identify, analyze, and evaluate cybersecurity threats, vulnerabilities, and potential business impacts.
Maintain enterprise risk registers and develop risk treatment plans and mitigation strategies.
Assess risks of new technologies, systems, business initiatives, cloud environments, and infrastructure changes.
Evaluate cloud architectures and configurations and partner with cloud engineering teams on security controls and mitigation.
Oversee vulnerability management effectiveness, prioritize risks, review scan and penetration-test findings, and support timely remediation.
Monitor threat intelligence and assess its potential impact on the organization.
Assess third-party and vendor cybersecurity risks, review vendor security evidence, monitor ongoing risk, and support remediation and contract security requirements.
Support compliance with cybersecurity regulations, standards, and frameworks, and contribute to policies, procedures, audits, governance, and risk committee activities.
Prepare executive and board-level cyber risk reports, presentations, dashboards, KRIs, and KPIs.
Communicate cyber risks and risk-based recommendations in business terms to executive and non-technical audiences.
Advise engineering, IT, security, product, and business teams on cybersecurity risk during project planning, system design, and strategic decisions.
Assess security and privacy risks associated with AI/ML systems and emerging technologies, and support AI governance and responsible AI practices.
Stay current on emerging technology risks and regulatory requirements.

Benefits

Up to four days per year to volunteer with a philanthropic organization.
Bespoke training and learning, mentoring platforms, and on-demand access to thousands of courses on LinkedIn Learning.
Open Vacation, 10 national holidays, and the opportunity to work from almost anywhere for up to four weeks a year.
401(k) match.
Health, vision, and dental insurance.
Parental leave.
Employee stock purchase plan (ESPP) offering company shares at a minimum 15% discount.
Employee assistance program support, mental health first aiders, and free access to a wellness app.
Global awards and recognition programs.
In-person and online social events, colleague groups, and networks.