Overview:
We are seeking a full-time Cyber Security Risk Analyst 1in our Olathe, KS location. In this role, you will be responsible for
IT Risk:
analyzing, measuring, and documenting the treatment of recorded risks throughout their lifecycle and determine/communicate residual risk as controls are implemented or identified.
Third Party Risk Management:
identifying risk by assessing and monitoring a third-party's adherence to Company's information security policies and related controls.
Qualifications:
Basic Qualifications
- Bachelor's Degree in Computer Science, Information Technology, Management Information Systems, or related field OR an equivalent combination of education and experience.
- Able to manage risk across all risk management lifecycle stages
- Awareness of industry frameworks and best practices (ex. NIST, ISO, OWASP, CIS, etc.)
- Knowledgeable of network design, security protocols and cloud integration security
- Be team-oriented with ability to influence people without having direct management authority and motivate them to successfully mitigate risk within required timelines.
- Demonstrated strong and effective verbal, written, and interpersonal communication skills along with strong analytical and problem-solving skills
- Capable of authoring quality and effective work documentation
Desired Qualifications
- Familiarity with project management concepts including design review, threat modeling and risk profiling
- Experience with Microsoft productivity apps (ex. Outlook, Word, Excel, etc.)
- Familiarity with data privacy compliance standards (ex. CCPA, GDPR, etc.)
- Familiarity with various regulatory compliance, information security, and risk management frameworks
Company International is an equal opportunity employer. Qualified applicants will receive consideration for employment without regard to race, religion, color, national origin, citizenship, sex, sexual orientation, gender identity, veteran's status, age or disability.
This position is eligible for Company's benefit program. Details can be found here: Company Benefits.
Responsibilities:
Essential Functions
All:
- Assist in creating risk profiles by identifying the information security risk factors based on data classification, design and functional purpose and use
- Contribute to determining when compensating controls are necessary due to inability to comply with the primary control requirements and participate in determining compensating controls when needed
- Work with system owners to identify mitigations for known risk
- Assist in creating and presenting risk assessment evaluations to management stakeholders articulating risk and impact analysis when information security control deficiencies are identified to ensure transparency and appropriate level of acceptance
- Contribute to management reports covering information security risk treatment, mitigation, and risk metrics
- Adhere to Information Security policies, standards, procedures, technical security baselines
IT Risk:
- Coordinate the collection and assessment of information to understand inherent and residual risk relevant to in scope systems and data for assessing various cyber risk.
- Evaluate the impact and likelihood deriving risk ratings using documented procedures and models.
- Track, measure, validate, and report on risk identification, stakeholder notification, and remediation efforts.
- Specific attention to the following control areas is required: authentication, authorization, access controls (network and user), secure transmission and storage, segmentation and network zoning, data flows, third party access, connectivity, and functional purpose.
- Participate in the strategy and day-to-day operations of the risk management function within Company's cyber security program
Third Party Risk Management:
- Participate in security and privacy assessments on third-party vendors and partners which includes assisting with discovery sessions and architecture assessments, analyzing questionnaire responses, reviewing due diligence documentation, participating in legal reviews, and assisting with risk reviews in accordance with established procedures