IT Risk Management Analyst

The IT Risk Management Analyst plays a critical role in ensuring the security, compliance, and resilience of an organization's IT systems and infrastructure. This role involves identifying, assessing, and mitigating potential risks and vulnerabilities that could impact the confidentiality, integrity, and availability of digital assets. The IT Risk Management Analyst collaborates with various teams to implement effective risk management strategies and ensure that the organization maintains a robust and secure IT environment. Essential Duties & Responsibilities:
Risk Assessment:

-
Identify and assess potential IT risks, including cybersecurity threats, vulnerabilities, and compliance gaps.

-
Conduct risk assessments to evaluate the potential impact and likelihood of identified risks.

-
Analyze and interpret data related to IT security incidents, breaches, and vulnerabilities.

Risk Mitigation:

-
Develop and implement risk mitigation plans to address identified vulnerabilities and threats.

-
Collaborate with IT and security teams to design and implement controls to reduce the organization's exposure to risks.

-
Stay up-to-date with emerging security threats and industry best practices to enhance the effectiveness of risk mitigation strategies.

Compliance and Regulation:

-
Monitor and ensure compliance with relevant IT regulations, standards, and frameworks (e.g., GDPR, FERPA, FFIEC, HIPAA, NIST, ISO 27001).

-
Assist in the development and maintenance of IT policies, procedures, and guidelines to ensure adherence to compliance requirements.

Security Incident Response:

-
Participate in incident response activities, providing expertise in analyzing and mitigating security incidents.

-
Collaborate with incident response teams to investigate and remediate security breaches or vulnerabilities.

Risk Reporting and Communication:

-
Prepare and present reports on IT risks, vulnerabilities, and mitigation efforts to management and relevant stakeholders.

-
Communicate complex technical concepts to non-technical audiences effectively.

Security Awareness and Training:

-
Assist in developing and delivering IT security awareness programs to educate employees about security best practices.

-
Provide guidance and training to employees regarding risk management procedures and policies.

Continuous Improvement:

-
Identify areas for process improvements and recommend solutions to enhance the overall IT risk management program.

-
Participate in the evaluation and implementation of new technologies and tools to enhance risk assessment and mitigation capabilities.

Job Skills:

-
Understanding of IT risk management principles, cybersecurity concepts, and industry standards.

-
Proficiency in risk assessment methodologies, vulnerability assessment tools, and security frameworks.

-
Excellent analytical and problem-solving skills, with the ability to assess complex situations and provide practical solutions.

-
Effective communication skills to convey technical information clearly to both technical and non-technical stakeholders.

-
Collaborative attitude with the ability to work across different teams and departments.

-
Experience with security incident response and familiarity with security tools and technologies.

Work Experience:
- 3 to 5 years in a similar role.

Education:
-
Bachelor's degree in Information Technology, Cybersecurity, Business, or a related field required.

Certificates, licenses and registrations:
-
Preference: Professional certifications such as Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC) Certified Information Security Manager (CISM), or Certified Information Systems Auditor (CISA) are advantageous.

Other:

-
Must be able to travel occasionally should a business need arise. For most roles travel would not be common. Travel may involve plane, car or metro. In accordance with ADA policies, reasonabl