Information Security Risk Analyst

Role Summary

Seeking a Mid-Level Information Security Risk Analyst to lead annual Third-Party Risk Assessments (TPA) for technical implementation vendors based on state security standards.

Operating alongside a lead analyst, this position owns the delivery of system and data inventories, risk registries, and Risk Assessment Reports (RAR).

Key Responsibilities

• Third-Party Risk Assessment: Perform third-party vendor risk assessments evaluating security evidence, conducting vendor interviews, and delivering actionable security feedback.
• Deliverable Ownership: Create and maintain System & Data Inventories, Risk Registries, and formal Risk Assessment Reports (RAR).
• Framework Compliance: Apply NIST SP 800-53, SP 800-30, SP 800-37, and the NC Statewide Information Security Manual to evaluate vendor compliance.
• Stakeholder Reporting: Prioritize and summarize risk assessment findings and status updates for project managers and executive leadership.

Required Skills & Qualifications

• NIST & Compliance Frameworks: 3+ years of hands-on experience applying NIST SP 800-53, SP 800-30, and SP 800-37 guidelines.
• Vendor Risk Auditing: 3+ years of experience conducting vendor interviews, evaluating technical evidence, and generating risk registry reports.
• Security Technologies: 5+ years of experience with mainstream operating systems, identity and access management (IAM), network security appliances, and cryptography.
• Education: Bachelor's degree with 2+ years of IT security experience, Associate degree with 3+ years, or equivalent experience.

Preferred Qualifications

• Industry professional certifications (CISSP, CISM, or equivalent).
• Experience evaluating against NIST Cybersecurity Framework (CSF) or HITRUST standards.