Senior Security Risk Analyst

Centene Corporation•Remote-MO, MO

2d•$87,700 - $157,800

About The Position

This role serves as the authoritative owner of the cybersecurity risk lifecycle management process within Enterprise Privacy & Security Risk Management (EPSRM). It is accountable for the integrity, structure, lifecycle management, and effectiveness of how cybersecurity risks are identified, documented, governed, monitored, and communicated across the enterprise, in alignment with enterprise risk management (ERM) expectations and Centene’s risk appetite. The position coordinates risk intake from multiple cybersecurity governance, risk, and compliance (GRC) workstreams—including assessments, control monitoring, testing, and issues management—by establishing standardized taxonomy, workflows, and documentation requirements. It ensures risks are traceable to underlying assets, threats, vulnerabilities, controls, and remediation activities to provide a defensible and auditable view of cybersecurity risk exposure. Working closely with cybersecurity risk owners, Enterprise Risk Management, technology and business stakeholders, and EPSRM leadership, the role maintains a clear, current, decision-ready view of Centene’s cybersecurity risk posture. It translates complex risk data into actionable insights through dashboards, recurring reporting, and trend analysis to support prioritization, accountability, and executive decision-making. The role also contributes to specialty GRC projects as assigned. These may include targeted risk or control initiatives, framework alignment, tooling or process enhancements, regulatory or audit support, metrics modernization, or maturity improvement efforts that advance EPSRM program objectives. Through steady-state operations and project work, the position supports disciplined, risk-informed decision-making and transparent, customer-centric communication. Applicants must be authorized to work in the U.S. without current or future employment-based visa sponsorship. Centene states that sponsorship is unavailable for this opportunity, including H-1B, L-1, O-1, H-1B1, F-1, J-1, OPT, and CPT.

Requirements

Bachelor’s degree in IT, MIS, Accounting, Finance, Business Administration, a related field, or equivalent experience.
At least 4 years of combined auditing and IT controls design experience.
Knowledge of IT systems and processes and experience evaluating internal technical control systems.
At least 4 years of experience in enterprise risk management, operational risk, cybersecurity GRC, audit, or related disciplines within a large or regulated enterprise environment.
Hands-on experience managing, administering, or materially contributing to a formal cybersecurity or technology risk register, including risk intake, documentation, reporting, and lifecycle management.
Strong working knowledge of risk assessment methodologies, risk taxonomies, and concepts including inherent risk, residual risk, risk appetite, risk tolerance, and risk treatment strategies.
Understanding of the cybersecurity risk management lifecycle, including identification, assessment, prioritization, treatment, monitoring, and reporting, and familiarity with dependencies across security, technology, and business functions.
Ability to work cross-functionally, facilitate discussions with senior and executive stakeholders, and translate complex technical or operational risks into clear, concise, decision-relevant insights.
Strong written and verbal communication skills, including the ability to produce executive-level reporting, dashboards, and documentation suitable for leadership, auditors, and regulators.
One or more of the following certifications is required: CISSP, Security+, CISM, CISA, CGEIT, or CRISC.
Must be authorized to work in the U.S. without the need for current or future employment-based visa sponsorship.

Nice To Haves

Experience supporting GRC initiatives or projects beyond steady-state operations, such as framework alignment, audit readiness, tooling enhancements, metrics initiatives, or process improvements.
Experience using Archer or comparable GRC platforms to manage risk data, workflows, and reporting.

Responsibilities

Own and manage the lifecycle and documentation of cybersecurity risks, including intake, documentation, validation, monitoring, escalation, and reporting.
Develop, define, and maintain standardized processes for capturing risks from cybersecurity GRC workstreams, including risk assessments, penetration testing, control monitoring, maturity assessments, and security issue management.
Design and maintain the cybersecurity risk register structure, including taxonomy, categorization, scoring attributes, lifecycle states, ownership models, escalation thresholds, workflows, and roles and responsibilities.
Ensure consistency, traceability, and auditability across captured cybersecurity risks.
Own and maintain the cybersecurity component of the enterprise risk register, ensuring risks are properly entered, clearly documented, consistently managed, and current.
Coordinate with Enterprise Risk Management to meet enterprise risk management program requirements and align the cybersecurity and enterprise risk management programs.
Engage cybersecurity risk owners and delegates to understand risks, root causes, drivers, impacts, mitigation strategies, remediation plans, projects, and control activities.
Coordinate across technology, security, compliance, and business teams to ensure complete and accurate risk representation and communicate risk register requirements and processes.
Serve as a subject matter resource for risk register usage, governance requirements, and lifecycle processes; advise stakeholders on documentation standards, ownership, status updates, and escalation protocols.
Provide regular reporting to Cybersecurity GRC leadership, EPSRM leadership, and risk owners on individual risks and the overall cybersecurity risk profile, including trends, aging, and progress.
Highlight top, emerging, and persistent cybersecurity risks to support prioritization, resource allocation, and executive decision-making.
Coordinate with teams responsible for penetration testing, risk assessments, control monitoring, and cybersecurity maturity assessments to evaluate upstream findings, translate them into risks when necessary, and document them accurately.
Coordinate with security issues management to maintain clear linkage between findings, issues, remediation actions, and documented risks.
Develop, maintain, and improve dashboards, scorecards, and recurring reporting artifacts communicating cybersecurity risk posture, trends, and management activity.
Partner with metrics, reporting, data, and analytics teams to improve risk reporting data quality, automation, consistency, and scalability.
Participate in specialty GRC projects, contributing subject matter expertise, documentation, analysis, and coordination for initiatives such as taxonomy refinement, framework or regulatory mapping, tooling enhancements, audit or examination support, lifecycle improvements, metrics governance, and risk deep dives.
Develop and maintain cybersecurity risk management program documentation, including charters, policies, standards, procedures, templates, guidance materials, and roadmaps related to the risk register and governance processes.
Keep program documentation current, organized, and accessible.
Align cybersecurity risk management practices and documentation with applicable frameworks and regulatory expectations, including NIST CSF, ISO/IEC 27001, HIPAA Security Rule, HITRUST CSF, SOC 1/SOC 2, and ARC AMPE.
Promote transparency, accountability, and risk-aware decision-making by delivering timely, high-quality, customer-focused risk insights.
Perform other duties as assigned and comply with all policies and standards.