Sr IT Risk Security Analyst

Symetra • ,

9d • $79,900 - $133,200 • Remote

About The Position

The Senior IT Risk and Security Analyst (RSA) is a critical member of the Information Security Officer's (ISO's) team. The RSA’s role is to act as an interface between IT, Audit Services and the business for overall IT risk management. The RSA must be able to understand our current IT Control environment including IT General Controls and ISO 27001 Information Security Critical Controls while improving our risk posture. The RSA coordinates with several stakeholders including business, audit services, and IT to manage, evaluate and remediate issues.

Requirements

• You’re an analytical problem solver with a strong understanding of information security, IT risk management, audit methodologies, compliance frameworks, and internal controls.
• You have experience managing complex risk assessments, audit programs, and compliance initiatives, with the ability to translate technical risks into business-focused recommendations.
• You’re an effective communicator who can confidently collaborate with executives, auditors, IT leaders, business stakeholders, and external vendors to influence positive outcomes.
• You thrive working independently while also serving as a trusted advisor, mentor, and subject matter expert for colleagues and cross-functional teams.
• You possess strong organizational skills and attention to detail, enabling you to manage multiple priorities, maintain accurate documentation, and deliver high-quality results in a fast-paced environment.

Nice To Haves

• Bachelor’s degree in information systems, Cybersecurity, Computer Science, Accounting, Business, or related field, or equivalent combination of education and experience.
• 5-8 years of experience in IT risk management, information security, IT audit, cybersecurity governance, compliance, or related disciplines.
• Professional certifications such as CISA, CISSP, CRISC, CISM, CIA, ISO 27001 Lead Implementer/Auditor, or other relevant credentials.
• Experience with SOX ITGCs, ISO 27001, IT risk assessment methodologies, vendor risk management, security governance, and audit lifecycle management.
• Demonstrated ability to influence stakeholders, lead initiatives, and communicate complex technical concepts to both technical and non-technical audiences.

Responsibilities

• Serve as a trusted advisor to IT and business teams by identifying technology, security, and operational risks, recommending effective controls, and ensuring risks are properly assessed, documented, and mitigated.
• Lead enterprise IT risk management activities, including annual risk assessments, risk committee facilitation, risk reporting, policy development, risk register management, and continuous improvement of the organization's risk management framework.
• Support third-party technology risk management across the vendor lifecycle, including risk tiering, pre-contract due diligence, security assessments, and periodic monitoring. Evaluate SOC reports, ISO 27001 certifications, security questionnaires, penetration tests, external security ratings, encryption and data-handling practices, AI usage, contractual controls, and business continuity capabilities; document risk ratings and findings, drive remediation, and escalate unresolved risks in partnership with Procurement, Legal, business owners, and security teams.
• Manage and enhance IT audit and compliance programs, including SOX IT General Controls (ITGCs), ISO 27001 security controls, regulatory requirements, and internal/external audit activities to ensure controls are designed and operating effectively.
• Partner with control owners, auditors, and business stakeholders to track audit findings, drive remediation efforts, provide training, and ensure sustainable compliance across technology and business functions.
• Evaluate third-party vendors, emerging technologies, and business initiatives to identify security and operational risks, implement monitoring controls, and support disaster recovery and business continuity planning efforts.
• Develop executive-level reporting and dashboards that communicate risk exposure, audit results, compliance status, and remediation progress to senior leadership and governance committees.
• Conduct reviews of information systems, business applications, infrastructure, and operational processes to assess security posture, control effectiveness, and alignment with company objectives.
• Maintain ownership of risk management tools and processes, ensuring accurate documentation, reporting, workflow management, and ongoing program maturity.

Benefits

• Flexible full-time or hybrid telecommuting arrangements
• 401(k) plan and take advantage of immediate vesting and company matching up to 6%
• Paid time away including vacation and sick time, flex days and ten paid holidays
• Company matching for community contributions

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: Associate degree