Sr. GRC Risk Analyst

Cyera • Creve Coeur, MO

8d • Remote

About The Position

Cyera is hiring a Senior GRC Analyst – Risk to build and operate its enterprise risk register. The role will establish the risk management framework, own the full risk lifecycle from identification through closure, and turn risk data into clear leadership decisions. It is a builder role that will create the foundation and operate the program as the company grows. The position reports to the GRC Manager and collaborates with Security, Engineering, IT, Legal, Privacy, Finance, and business leaders.

The analyst will design Cyera’s enterprise risk management methodology, including its taxonomy, likelihood and impact scoring model, risk appetite and tolerance thresholds, treatment options, ownership, escalation, and governance cadence. The role will align the program with recognized security and risk frameworks, maintain a consistent and audit-ready risk register, and run recurring assessments and workshops with control owners and business stakeholders.

The position also tracks treatment plans, remediation dates, and risk acceptances; connects risks with controls, policies, audit findings, vendor risks, and incidents; and maintains supporting evidence and documentation. It produces dashboards and reports for the GRC Manager, CISO, governance committees, executives, and leadership, and prepares risk information for audits and customer security reviews. The analyst will scale and improve risk processes with GRC tools and workflows, integrate risk management with related programs, and train risk owners using reusable templates, guides, and playbooks.

Requirements

• 3 to 5 years of experience in GRC, IT risk, information security risk, or enterprise risk management.
• Hands-on experience building or significantly maturing a risk register and risk assessment process.
• Working knowledge of at least two of ISO 27001, NIST CSF, NIST 800-30, NIST 800-53, or SOC 2.
• Strong grasp of risk scoring, risk appetite, treatment, and acceptance, with the judgment to apply them practically.
• Experience mapping risks to controls and supporting external audits.
• Ability to lead risk conversations with engineers and executives and hold owners accountable without slowing the business.
• Clear, concise writing and reporting skills.
• Comfort working in a fast-moving SaaS or cloud environment with changing priorities.
• Bachelor’s degree in a related field, or equivalent experience.

Nice To Haves

• Certifications such as CRISC, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, or ISO 31000 Risk Manager.
• Experience with GRC platforms such as Anecdotes, Drata, Vanta, ServiceNow IRM, or Archer, and Jira workflows.
• Exposure to AI risk management, ISO 42001, or the EU AI Act.
• Familiarity with multi-framework environments such as PCI DSS, FedRAMP, C5, or ENS.
• Experience at a security or data security vendor.
• Data Privacy and Protection experience.

Responsibilities

• Design and document the enterprise risk management methodology, including taxonomy, scoring, appetite and tolerance thresholds, and treatment options.
• Align the risk program to frameworks such as ISO 27001, NIST CSF, NIST 800-30, SOC 2, and ISO 42001 for AI risk.
• Establish risk ownership, RACI, escalation paths, and governance cadence with the GRC Manager and leadership.
• Standardize risk register structure, naming conventions, and ID nomenclature to make risks consistent and audit-ready.
• Own the enterprise risk register through identification, assessment, treatment, monitoring, acceptance, and closure.
• Run recurring risk assessments and workshops with control owners and business stakeholders.
• Track treatment plans, remediation due dates, and risk acceptances, and follow up with owners.
• Map risks to controls, policies, audit findings, vendor risks, and incidents.
• Maintain evidence and documentation supporting internal and external audits.
• Produce risk reporting and dashboards for the GRC Manager, CISO, and governance committees, including top risks, trends, and KRIs.
• Translate technical and operational risk into clear business language for executives.
• Prepare risk inputs for audits, customer security reviews, and board or leadership updates.
• Automate risk intake, scoring, and reporting through GRC tooling and simple workflows.
• Integrate risk management with TPRM, vulnerability management, incident response, AI governance, and change management.
• Train risk owners and create reusable templates, guides, and playbooks.

Benefits

• Ability to work remotely, with office setup reimbursement.
• Unlimited PTO.
• Paid holidays and sick time.
• Health, vision, and dental insurance.
• Life and short- and long-term disability insurance.
• Standard benefits and equity package.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior