Sr. GRC Risk Analyst

Cyera•St. Louis, MO

10h•$100,000 - $120,000

About The Position

Cyera is hiring a Senior GRC Analyst – Risk to build and operate its enterprise risk register. The role will design the risk management framework, manage the full risk lifecycle from identification through closure, and translate risk data into clear leadership decisions. It is a builder role that establishes the foundation and operates it as the company scales. The position reports to the GRC Manager and collaborates with Security, Engineering, IT, Legal, Privacy, Finance, and business leaders. It includes developing risk methodology and governance, running assessments and maintaining the enterprise risk register, reporting risk insights, supporting audits, and improving risk processes through tooling, integrations, training, and reusable materials.

Requirements

3 to 5 years of experience in GRC, IT risk, information security risk, or enterprise risk management.
Hands-on experience building or significantly maturing a risk register and risk assessment process.
Working knowledge of at least two of ISO 27001, NIST CSF, NIST 800-30, NIST 800-53, or SOC 2.
Strong understanding of risk scoring, risk appetite, treatment, and acceptance, with practical judgment in applying them.
Experience mapping risks to controls and supporting external audits.
Ability to lead risk conversations with engineers and executives and hold owners accountable without slowing the business.
Clear, concise writing and reporting skills.
Comfort working in a fast-moving SaaS or cloud environment with changing priorities.
Bachelor's degree in a related field, or equivalent experience.

Nice To Haves

Certifications such as CRISC, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, or ISO 31000 Risk Manager.
Experience with GRC platforms such as Anecdotes, Drata, Vanta, ServiceNow IRM, or Archer, and Jira workflows.
Exposure to AI risk management, ISO 42001, or the EU AI Act.
Familiarity with multi-framework environments such as PCI DSS, FedRAMP, C5, or ENS.
Experience at a security or data security vendor.
Data Privacy and Protection experience.

Responsibilities

Design and document the enterprise risk management methodology, including taxonomy, likelihood and impact scoring, risk appetite and tolerance thresholds, and treatment options.
Align the program with recognized frameworks, including ISO 27001, NIST CSF, NIST 800-30, SOC 2, and ISO 42001 for AI risk.
Establish risk ownership, RACI, escalation paths, and governance cadence with the GRC Manager and leadership.
Standardize risk register structure, naming conventions, and ID nomenclature.
Own the enterprise risk register through identification, assessment, treatment, monitoring, acceptance, and closure.
Conduct recurring risk assessments and workshops with control owners and business stakeholders.
Track treatment plans, remediation due dates, and risk acceptances, and follow up with owners.
Map risks to controls, policies, audit findings, vendor risks, and incidents.
Maintain evidence and documentation for internal and external audits.
Produce risk reporting and dashboards for the GRC Manager, CISO, and governance committees, including top risks, trends, and KRIs.
Translate technical and operational risks into clear business language for executives.
Prepare risk inputs for audits, customer security reviews, and board or leadership updates.
Automate intake, scoring, and reporting using GRC tooling and workflows such as Jira, GRC platforms, and spreadsheets.
Integrate risk management with TPRM, vulnerability management, incident response, AI governance, and change management.
Train risk owners and create reusable templates, guides, and playbooks.