cybersecurity risk analyst

Next Ventures

<div>
 <p>
  We are partnering with a global organisation seeking a
  <strong>
   Cybersecurity Risk Analyst
  </strong>
  to join their Global Cyber &amp; Information Security function. This role is focused on third-party/vendor risk assessments, supporting business initiatives by identifying, assessing, and mitigating cybersecurity risks while ensuring alignment with internal policies and industry standards.
 </p>
 <p>
  Location: Denver, Colorado, USA
 </p>
 <p>
  <br/>
 </p>
 <p>
  Experience Required
 </p>
 <ul>
  <li>
   3+ years&rsquo; experience in cybersecurity risk management, IT security controls, or IT audit
  </li>
  <li>
   Proven experience conducting third-party/vendor risk assessments within enterprise environments
  </li>
  <li>
   Strong understanding of industry frameworks such as NIST, ISO 27001, SOC 1/2, PCI-DSS, and GDPR
  </li>
  <li>
   Familiarity with risk assessment methodologies and tools such as SIG, CAIQ, and audit-based approaches
  </li>
  <li>
   Experience reviewing and evaluating security controls, policies, and compliance documentation
  </li>
  <li>
   Relevant certifications such as CISSP, CISM, CISA, CRISC, or Security+ are preferred
  </li>
  <li>
   Ability to communicate complex security concepts clearly to both technical and non-technical stakeholders
  </li>
  <li>
   Strong stakeholder management skills with the ability to influence decision-making
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  Key Responsibilities
 </p>
 <ul>
  <li>
   Conduct detailed cybersecurity risk assessments for third-party vendors and business partners
  </li>
  <li>
   Review and evaluate security controls to ensure alignment with internal policies and regulatory requirements
  </li>
  <li>
   Develop and document risk profiles using questionnaires, frameworks, and internal standards
  </li>
  <li>
   Provide clear, actionable recommendations to mitigate identified risks
  </li>
  <li>
   Collaborate with IT, security, and business teams to support secure project delivery
  </li>
  <li>
   Advise stakeholders on security policies, regulatory obligations, and best practices
  </li>
  <li>
   Maintain accurate documentation of assessments within internal risk management platforms
  </li>
  <li>
   Report on risk posture, findings, and remediation progress to senior stakeholders
  </li>
  <li>
   Support the review and approval of security policy exceptions and provide recommendations
  </li>
  <li>
   Contribute to the continuous improvement of security processes, frameworks, and tools
  </li>
 </ul>
 <p>
  <br/>
 </p>
 <p>
  If interested, please apply with your updated CV.
 </p>
</div>


Cybersecurity Risk Analyst

Citizens

<div><div><p><b>Description</b></p><p>
The Enterprise Technology &amp; Security (ETS) Risk Senior Analyst leads the identification, assessment, and mitigation of technology-related risks, ensuring the organization's risk management practices are robust and effective. Serving as a key contributor within a first-line risk team, this role works directly with Risk Managers to execute control monitoring and testing that aligns with the bank's risk appetite framework, regulatory expectations, and industry standards. You will oversee end-to-end testing execution, apply advanced risk judgment, and mentor analysts to strengthen testing consistency and documentation quality. This role requires the ability to influence stakeholders through data-driven insights, proactively identify emerging risks, and drive continuous improvements in monitoring, analytics, and automation. This role requires strong professional judgment, high quality documentation, and timely communication to support a resilient control environment and informed risk decisions. The Senior Analyst applies deep knowledge of frameworks such as Cybersecurity Risk Institute (CRI) Profile, NIST 800-53, and NIST Cybersecurity Framework to assess risk and drive meaningful improvements in the bank's security and technology risk posture.</p><div><p><b>
Responsibilities</b></p></div><ul><li><p>
Lead planning and execution of control monitoring and testing across multiple complex technology and cybersecurity processes, ensuring adherence to methodology, timelines, and quality standards.</p></li><li><p>
Independently perform and/or oversee control design and operating effectiveness testing; review workpapers and evidence for completeness, accuracy, and audit readiness.</p></li><li><p>
Assess material controls and evaluate whether enhanced controls and remediation actions are effective to support issue validation and closure.</p></li><li><p>
Ensure testing results are documented clearly and accurately in the system of record and supporting tools, producing audit-ready documentation suitable for QA, Internal Audit, and Regulatory review.</p></li><li><p>
Proactively escalate significant control deficiencies, emerging risks, and delivery risks; drive follow-up with stakeholders to achieve timely resolution.</p></li><li><p>
Lead issue validation testing to confirm remediation effectiveness and provide evidence-based recommendations to support issue closure.</p></li><li><p>
Support and/or lead Risk and Control Self-Assessments (RCSAs), including creation and validation of process maps that reflect key processes, risks, and controls.</p></li><li><p>
Lead identification and prioritization of opportunities to enhance testing through automation, data analytics, and improved key control metrics (KRIs/KCMs); partner with stakeholders to support implementation.</p></li><li><p>
Strengthen continuous monitoring by refining metrics, improving coverage, and leveraging trend and anomaly analysis to increase risk signal and reduce noise.</p></li><li><p>
Build and expand trusted relationships across business and technology stakeholders; influence outcomes through compelling, fact-based analysis and clear recommendations.</p></li><li><p>
Mentor junior analysts on risk methodology, documentation standards, and analytical techniques.</p></li><li><p>
Stay current on regulatory changes, emerging technology risks, and evolving industry frameworks.</p></li><li><p>
Proactively pursue ongoing professional development, including relevant certifications, industry training, etc. to maintain current knowledge in a rapidly evolving field.</p></li></ul><div><p><b>
Experience &amp; Skills</b></p></div><p>
Required:</p><ul><li><p>
5&ndash;7 years of progressive experience in IT risk management, information security, or internal audit.</p></li><li><p>
Working knowledge of control frameworks including CRI Profile, NIST 800-53, NIST CSF, COBIT, and/or ITIL.</p></li><li><p>
Experience conducting or supporting RCSAs, control testing, and risk assessments in a regulated environment.</p></li><li><p>
Strong analytical and problem-solving skills with the ability to interpret complex data and translate findings into actionable recommendations.</p></li><li><p>
Demonstrated ability to manage multiple concurrent priorities with minimal oversight.</p></li><li><p>
Strong interpersonal and written communication skills; able to convey technical risk concepts to non-technical stakeholders.</p></li><li><p>
Proficiency with GRC platforms (e.g., Archer), ITSM tools (e.g., ServiceNow, Jira), and security tools (e.g., Splunk, Qualys, DataDog, Wiz, and/or CyberArk).</p></li><li><p>
Experience with cloud platforms such as AWS, Azure</p></li><li><p>
Familiarity with reporting tools (Tableau, PowerBi)</p></li></ul><p>
Preferred:</p><ul><li><p>
Experience in a regulated financial institution or banking environment.</p></li><li><p>
Familiarity with cloud infrastructure risk, cyber recovery, or third-party risk management.</p></li><li><p>
Prior experience responding to regulatory exams or supporting audit remediation.</p></li></ul><div><p><b>
Education</b></p></div><ul><li><p>
Bachelor's degree in Information Technology, Cybersecurity, Business, or a related field required; Master's degree preferred.</p></li><li>
One or more of the following certifications are preferred:</li><li>
CISA (Certified Information Systems Auditor)</li><li>
CRISC (Certified in Risk and Information Systems Control)</li><li>
CISM (Certified Information Security Manager)</li><li>
AWS Cloud Practitioner or Microsoft Azure Fundamentals</li></ul><p><b>
Hours &amp; Work Schedule</b></p><ul><li>
Hours per Week: 40</li><li>
Work Schedule: Monday-Friday</li><li>
Hybrid: 4 days per week onsite, 1 day remote</li></ul><p><i>
Some job boards have started using jobseeker-reported data to estimate salary ranges for roles. If you apply and qualify for this role, a recruiter will discuss accurate pay guidance.</i></p><p><b>
Equal Employment Opportunity</b></p><p>
Citizens, its parent, subsidiaries, and related companies (Citizens) provide equal employment and advancement opportunities to all colleagues and applicants for employment without regard to age, ancestry, color, citizenship, physical or mental disability, perceived disability or history or record of a disability, ethnicity, gender, gender identity or expression, genetic information, genetic characteristic, marital or domestic partner status, victim of domestic violence, family status/parenthood, medical condition, military or veteran status, national origin, pregnancy/childbirth/lactation, colleague&rsquo;s or a dependent&rsquo;s reproductive health decision making, race, religion, sex, sexual orientation, or any other category protected by federal, state and/or local laws. At Citizens, we are committed to fostering an inclusive culture that enables all colleagues to bring their best selves to work every day and everyone is expected to be treated with respect and professionalism. Employment decisions are based solely on merit, qualifications, performance and capability.</p></div>
<div><h2 class="jobSectionHeader"><b>Background Check</b></h2>
<p>Any offer of employment is conditioned upon the candidate successfully passing a background check, which may include initial credit, motor vehicle record, public record, prior employment verification, and criminal background checks. Results of the background check are individually reviewed based upon legal requirements imposed by our regulators and with consideration of the nature and gravity of the background history and the job offered. Any offer of employment will include further information.</p>
</div><div><h2 class="jobSectionHeader"><b>Benefits</b></h2>
<p>We offer competitive pay, comprehensive medical, dental and vision coverage, retirement benefits, maternity/paternity leave, flexible work arrangements, education reimbursement, wellness programs and more.</p><br>
<div></div>
</div><div><h2 class="jobSectionHeader"><b>Awards We've Received</b></h2>
<div><div><div>Glassdoor Best Place to Work in Consulting, Finance &amp; Insurance</div>
</div><div><div>The Banker's
<br>
US Bank of the Year</div>
</div><div><div>Dave Thomas Foundation&rsquo;s Best Adoption-Friendly Workplace</div>
</div><div><div>Disability:IN Best Places to Work for Disability Inclusion</div>
</div><div><div>Human Rights Campaign Corporate Equality Index 100 Award</div></div></div></div></div><p></p>

Senior Technology Risk Analyst – Monitoring and Testing

Stellar Hunters

<div><h4 class="jobSectionHeader"><b>Job Summary</b></h4>
<p>
We are seeking a Cyber GRC Specialist to support and advance the company&rsquo;s cybersecurity governance, risk management, and compliance (GRC) initiatives. The successful candidate will collaborate with Security, IT, Legal, Privacy, Compliance, and business teams to identify and manage cyber risk, implement controls, maintain compliance with applicable frameworks and regulations, and support continuous improvement of the security posture. This role requires a pragmatic, consultative approach and the ability to translate technical security concepts into business risk terms.</p>
<h4 class="jobSectionHeader"><b>Key Responsibilities</b></h4>
<h5 class="jobSectionHeader"><b>Governance &amp; Policy</b></h5>
<ul>
<li><p>Develop, maintain, and operationalize cybersecurity policies, standards, and procedures aligned with industry frameworks and regulatory requirements (e.g., NIST CSF, ISO 27001, SOC 2, PCI, relevant regional regulations).</p></li>
<li><p>Support security governance forums and reporting to senior leadership and stakeholders on cyber risk, control effectiveness, and remediation progress.</p></li>
<li><p>Collaborate with cross-functional teams to ensure security requirements are integrated into business processes, projects, and third-party relationships.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Risk Management &amp; Assessments</b></h5>
<ul>
<li><p>Conduct and coordinate risk assessments, control gap analyses, and threat/risk modeling for systems, applications, and third-party services.</p></li>
<li><p>Maintain the risk register, prioritize remediation activities, and track closure of identified vulnerabilities and control deficiencies.</p></li>
<li><p>Perform vendor security and risk assessments; review third-party contracts and recommend appropriate security controls and contractual language.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Compliance &amp; Audit Support</b></h5>
<ul>
<li><p>Support internal and external compliance initiatives, audits, and certifications (e.g., SOC 2, ISO 27001), including evidence collection, control testing, and remediation coordination.</p></li>
<li><p>Monitor regulatory and industry compliance requirements and translate obligations into practical control and process requirements across the organization.</p></li>
<li><p>Prepare and maintain documentation, control narratives, and artifacts required for assessments and regulatory inquiries.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Incident Response &amp; Continuous Improvement</b></h5>
<ul>
<li><p>Participate in incident response planning and post-incident reviews; advise on control improvements and regulatory/contractual notification considerations.</p></li>
<li><p>Collaborate with Security Operations and IT teams to ensure controls are effectively implemented, monitored, and improved based on lessons learned and evolving threats.</p></li>
<li><p>Identify opportunities to automate control monitoring, reporting, and GRC workflows using GRC platforms and security tooling.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Training, Awareness &amp; Advisory</b></h5>
<ul>
<li><p>Develop and deliver role-based security awareness, GRC guidance, and targeted training for employees, contractors, and business partners.</p></li>
<li><p>Provide practical, risk-based advisory to Product, Engineering, IT, and business teams on secure design, control selection, and compliance requirements.</p></li>
<li><p>Act as a trusted advisor for security and compliance questions related to new projects, cloud deployments, and third-party integrations.</p></li>
</ul>
<h4 class="jobSectionHeader"><b>Required Qualifications - Skills &amp; Experience</b></h4>
<ul>
<li><p>Bachelor&rsquo;s degree in Information Security, Computer Science, Cybersecurity, Risk Management, or a related field, or equivalent practical experience.</p></li>
<li><p>3+ years of demonstrated experience in cybersecurity GRC, risk management, compliance, or related roles within a commercial or regulated environment.</p></li>
<li><p>Familiarity with common cybersecurity frameworks and standards (e.g., NIST CSF, ISO 27001, SOC 2) and practical experience applying them.</p></li>
<li><p>Experience performing risk assessments, vendor/security assessments, control gap analysis, and supporting audits or certifications.</p></li>
<li><p>Working knowledge of cloud security concepts (AWS, Azure, GCP), identity and access management, and common security controls.</p></li>
<li><p>Strong written and verbal communication skills with the ability to document controls, prepare executive reports, and communicate with technical and non-technical stakeholders.</p></li>
<li><p>Experience with GRC platforms, ticketing systems, and security assessment tools; comfortable working in cross-functional, fast-paced environments.</p></li>
</ul>
<h4 class="jobSectionHeader"><b>Preferred Qualifications</b></h4>
<ul>
<li><p>Relevant certifications such as CISSP, CISM, CRISC, CGEIT, or certification in GRC platforms preferred.</p></li>
<li><p>Experience supporting SOC 2, ISO 27001, or other compliance programs and working with external auditors.</p></li>
<li><p>Prior exposure to privacy requirements and data protection interactions with cybersecurity controls is a plus.</p></li>
<li><p>Experience in cloud-native environments, DevSecOps practices, and automation of control monitoring is advantageous.</p></li>
</ul>
<h4 class="jobSectionHeader"><b>Work Environment &amp; Compensation</b></h4>
<ul>
<li><p>Full-time role with a hybrid onsite/remote work model; occasional travel may be required for stakeholder meetings, audits, or vendor engagements.</p></li>
<li><p>Competitive salary commensurate with experience and a comprehensive benefits package, including health insurance, retirement plan options, and paid time off.</p></li>
<li><p>Opportunities for professional development, certification support, and career progression within Security, Compliance, and Risk functions.</p></li>
<li><p>Inclusive and respectful workplace culture that values diversity, equity, and work-life balance.</p></li></ul></div>

Cyber GRC Specialist

Sumitomo Group

<div><p>SMBC Group is a top-tier global financial group. Headquartered in Tokyo and with a 400-year history, SMBC Group offers a diverse range of financial services, including banking, leasing, securities, credit cards, and consumer finance. The Group has more than 130 offices and 80,000 employees worldwide in nearly 40 countries. Sumitomo Mitsui Financial Group, Inc. (SMFG) is the holding company of SMBC Group, which is one of the three largest banking groups in Japan. SMFG&rsquo;s shares trade on the Tokyo, Nagoya, and New York (NYSE: SMFG) stock exchanges.</p><p></p><p><br>
In the Americas, SMBC Group has a presence in the US, Canada, Mexico, Brazil, Chile, Colombia, and Peru. Backed by the capital strength of SMBC Group and the value of its relationships in Asia, the Group offers a range of commercial and investment banking services to its corporate, institutional, and municipal clients. It connects a diverse client base to local markets and the organization&rsquo;s extensive global network. The Group&rsquo;s operating companies in the Americas include Sumitomo Mitsui Banking Corp. (SMBC), SMBC Nikko Securities America, Inc., SMBC Capital Markets, Inc., SMBC MANUBANK, JRI America, Inc., SMBC Leasing and Finance, Inc., Banco Sumitomo Mitsui Brasileiro S.A., and Sumitomo Mitsui Finance and Leasing Co., Ltd.</p><div><div><div><h2 class="jobSectionHeader"><b>
Role Description</b></h2></div><div><p>
The Risk Associate role supports the operationalization of the second line of defense Risk oversight of information technology, cybersecurity, and data risk for the SMBC Group Americas Division (AD) by performing independent review, effective challenge, and risk analysis in alignment with regulatory expectations, internal/head office policies, and industry standards.</p><p></p><p><br>
The Risk Management Department (RMDAD) is the second line of defense in its role of monitoring and assessing business practices as related to the risk appetite framework for SMBC. Within the RMDAD, the Tech, Data and Cyber Risk Oversight (TDCRO) establish technology, data and cyber risk management policies and framework with defined roles and responsibilities across first and second lines.</p></div></div><div><div><h2 class="jobSectionHeader"><b>
Role Responsibilities:</b></h2></div><div><p>
Supports the TDCRO management in ensuring IT, data management, and cybersecurity risks are adequately governed, managed and controlled.</p><p>
Supports the independent review and credible challenge of 1st Line of Defense risk assessments, controls, metrics, and remediation plans related to IT, data, and cyber risk domains.</p><p>
Assist in the maintenance and periodic update of technology, data, and cybersecurity risk management frameworks, policies, standards, and procedures.</p><p>
Provides review and challenge on IT, data management and cybersecurity policies, standards, control framework, risk metrics/indicators, risk and control self-assessment (&ldquo;RCSA&rdquo;).</p><p>
Support the preparation of technology, data, and cybersecurity risk reporting for management and risk committees, including issue tracking and escalation.</p><p>
Collaborate with cross-functional stakeholders across risk, technology, cybersecurity, and data teams</p></div></div><div><div><h2 class="jobSectionHeader"><b>
Qualifications and Skills</b></h2></div><p></p><div><p><br>
Well-versed in technology &amp; cyber risk practices with the ability to connect and align with the firm&rsquo;s operational risk management processes.</p><p>
2+ years of direct work experience within the financial services industry, with IT risk management, control testing, regulatory/audit, or cybersecurity experience.</p><p>
Foundational understanding of enterprise risk management concepts, including risk assessment, control design, issue management, and RCSAs.</p><p>
Working knowledge across multiple technology, cyber, or data risk domains (e.g., SDLC, application security, Data Management, IT governance, infrastructure Architecture, IT asset management (incl. End of Life and Shadow IT), Infrastructure management application lifecycle management, change management, back-up and availability of critical systems, Service management, Event, Problem and incident management, Helpdesk, SLA- service quality, Cloud, &hellip; ).</p><p>
Familiarity with technology, cyber and data risk management industry frameworks and standards (e.g., NIST, ISO, COBIT).</p><p>
Foundational knowledge of Tech/Cyber/Data Management regulatory guidance</p><p>
Strong written communication skills, with experience supporting management or committee-level reporting.</p><p>
Proficiency in Excel and PowerPoint; experience with Power BI or data visualization tools preferred.</p><p>
Strong organizational skills with ability to successfully manage multiple, concurrent priorities.</p><p>
Work effectively in a matrixed environment and across various organizational levels, where flexibility, collaboration, and adaptability are important.</p><p>
Strong desire to deliver a quality work product in a timely and efficient manner.</p><p>
Bachelor&rsquo;s/University degree required and Master&rsquo;s degree preferred.</p><p>
CISA, CRISC, CISM, CISSP certifications (or exam taken) preferred.</p></div></div></div><p>
SMBC&rsquo;s employees participate in a Hybrid workforce model that provides employees with an opportunity to work from home, as well as, from an SMBC office. SMBC requires that employees live within a reasonable commuting distance of their office location. Prospective candidates will learn more about their specific hybrid work schedule during their interview process. Hybrid work may not be permitted for certain roles, including, for example, certain FINRA-registered roles for which in-office attendance for the entire workweek is required.</p><p></p><p><br>
SMBC provides reasonable accommodations during candidacy for applicants with disabilities consistent with applicable federal, state, and local law. If you need a reasonable accommodation during the application process, please let us know at accommodations@smbcgroup.com.</p></div>

IT, Data and Cyber Risk Oversight Associate

Bechtel

<div><p><b>Requisition ID: 292696</b></p><ul><li><b>
Relocation Authorized: None</b></li><li><b>
Telework Type: Part-Time Telework</b></li><li><b>
Work Location: Reston, VA</b></li></ul><p></p><div><div><div><h2 class="jobSectionHeader"><b><br>
Extraordinary teams building inspiring projects:</b></h2></div><div><p>
Since 1898, we have helped customers complete more than 25,000 projects in 160 countries on all seven continents that have created jobs, grown economies, improved the resiliency of the world's infrastructure, increased access to energy, resources, and vital services, and made the world a safer, cleaner place.</p><p>
Differentiated by the quality of our people and our relentless drive to deliver the most successful outcomes, we align our capabilities to our customers' objectives to create a lasting positive impact. We serve the Infrastructure; Nuclear, Security &amp; Environmental; Energy; Mining &amp; Metals, and the Manufacturing and Technology markets. Our services span from initial planning and investment, through start-up and operations.</p><p>
Core to Bechtel is our Vision, Values and Commitments. They are what we believe, what customers can expect, and how we deliver. Learn more about our extraordinary teams building inspiring projects in our Impact Report.</p></div></div><div><div><h2 class="jobSectionHeader"><b>
Job Summary:</b></h2></div><div><p>
The Manager, Cybersecurity Risk Management focuses efforts on managing and reporting on cyber risks globally across Bechtel, playing a crucial role in assessing and managing risk, and driving mitigation plans associated with our wider cybersecurity program. The manager drives a comprehensive risk management program, while supporting peer cybersecurity teams in maturing and standardizing their programs. The manager identifies and mitigates security risks; provides subject matter expertise and technical guidance to process owners; partners with Service Owners, GBU Managers, IT Architecture, Operations and Support, and Software Development, to contribute to the reporting of a comprehensive view of the security risk posture and its impact on the business.</p></div></div><div><div><h2 class="jobSectionHeader"><b>
Major Responsibilities:</b></h2></div><div><p>
Risk Oversight</p><ul><li>
Develops and maintains a comprehensive cybersecurity risk management strategy, leads enterprise-wide cyber risk assessments and mitigation / remediation activities.</li><li>
Collaborates with IT, legal, compliance, and business units to ensure risk mitigation strategies are embedded in operations.</li><li>
Monitors emerging threats and risk posture and activities accordingly.</li><li>
Presents risk analysis, metrics, and mitigation plans to management and stakeholders.</li><li>
Identifies risk and mitigating controls for information security exceptions based on adherence to relevant company policies, standards, baselines, and industry standards (e.g., ISO 27001, NIST, GDPR, HIPAA, CIS, FedRAMP).</li><li>
Mentors and develops junior risk analysts and cybersecurity professionals.</li><li>
Assists with the administration and maintenance of the ServiceNow GRC platform.</li></ul><p>
Strategic Leadership, Business Partnership &amp; Enablement</p><ul><li>
Translates risk insights into strategic decisions and enterprise-wide policies.</li><li>
Contributes to the design of cybersecurity strategies by advising on risk reduction priorities related to exception and risk register trends.</li><li>
Develops metrics to track exception mitigation rates, approval / review rates, aging, and SLA compliance.</li><li>
Drives initiatives that reduce recurring exception requests through enterprise-wide solutions.</li></ul><p>
Analytics</p><ul><li>
Monitors the effectiveness of the information security exceptions process in accordance with agreed upon metrics and performance measures to drive continuous improvements.</li><li>
Conducts root cause analysis on recurring issues to enhance process efficiency and reduce exception requests.</li><li>
Collaborates with cross-functional teams to gather, interpret, and validate mitigating controls to ensure accuracy and relevance.</li></ul></div></div><div><div><h2 class="jobSectionHeader"><b>
Education and Experience Requirements:</b></h2></div><div><ul><li>
Requires bachelor&rsquo;s degree plus 8+ years experience in information security risk, with at least 3 years in a risk management role or similar function.</li></ul></div></div><div><div><h2 class="jobSectionHeader"><b>
Required Knowledge and Skills:</b></h2></div><div><ul><li>
Strong knowledge of cybersecurity frameworks, company policies, and regulatory requirements.</li><li>
Strong expertise across commercial and government cloud services (AWS, Azure, GCP, OCI, etc.), on-premises and application environments.</li><li>
Experience with tools such as ServiceNow, GRC tools, Power BI, and cloud technologies.</li><li>
Strong knowledge of risk frameworks (e.g., ISO 27005, NIST, ISO, PCI, SOX, etc.).</li><li>
Proven ability to translate complex technical concepts into plain language for decision-makers.</li><li>
Skilled in preparing polished deliverables that support informed decision-making.</li><li>
Team player who builds trust across technical and non-technical teams.</li><li>
Demonstrated ability to work independently, adapt quickly, and drive tasks forward with limited direction.</li><li>
Strong project management and delegation skills across diverse, cross-functional initiatives</li></ul><p></p><p><br>
Preferred:</p><ul><li>
Certifications such as CISSP, CISM, CRISC, or CISA.</li><li>
5+ years of prior experience in EPCM (Engineering, Procurement, Construction / Project Management). Prefer global company background and/or Fortune 500 and/or EPC industry.</li><li>
Comfortable working in a highly iterative environment, both structured and unstructured.</li><li>
Metrics and visualization tools knowledge a plus (i.e., ServiceNow, Power BI, Tableau,).</li><li>
Advanced user of M365 Suite to prepare all project plans, deliverables, presentations, reports, and findings.</li></ul></div></div><div><div><h2 class="jobSectionHeader"><b>
Total Rewards/Benefits:</b></h2></div><div><p>
For decades, Bechtel has worked to inspire the next generation of employees and beyond! Because our teams face some of the world's toughest challenges, we offer robust benefits to ensure our people thrive. Whether it is advancing careers, delivering programs to enhance our culture, or providing time to recharge, Bechtel has the benefits to build a legacy of sustainable growth. Learn more at Bechtel Total Rewards</p></div></div><div><div><h2 class="jobSectionHeader"><b>
Diverse teams build the extraordinary:</b></h2></div><div><p>
As a global company, Bechtel has long been home to a vibrant multitude of nationalities, cultures, ethnicities, and life experiences. This diversity has made us a more trusted partner, more effective problem solvers and innovators, and a more attractive destination for leading talent.</p><p>
We are committed to being a company where every colleague feels that they belong-where colleagues feel part of &quot;One Team,&quot; respected and rewarded for what they bring, supported in pursuing their goals, invested in our values and purpose, and treated equitably.</p></div></div></div><p></p><p><b><i><br>
Bechtel is an Equal Opportunity Employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity and expression, age, national origin, disability, citizenship status (except as authorized by law), protected veteran status, genetic information, and any other characteristic protected by federal, state or local law. Applicants with a disability, who require a reasonable accommodation for any part of the application or hiring process, may e-mail their request to </i></b><b>acesstmt@bechtel.com</b></p></div>

Manager, Cybersecurity Risk Management

<div><p><b>Position Type :
</b></p>Full time<p><b>
Type Of Hire :
</b></p>Experienced (relevant combo of work and education)<p><b>
Education Desired :
</b></p>Bachelor of Computer Science<p></p><p><b>
Job Description</b></p><p>
We are FIS. Our technology powers the world&rsquo;s economy and our teams bring innovation to life. We champion diversity to deliver the best products and solutions for our colleagues, clients and communities. If you&rsquo;re ready to start learning, growing and making an impact with a career in fintech, we&rsquo;d like to know: Are you FIS?</p><p></p><p><b>
About the role:</b></p><p>
You will supports FIS&rsquo;s risk management and assurance programs by executing control testing and regulatory assessments across technology, cybersecurity, and enterprise risk areas. This role focuses on evaluating control design and operating effectiveness to ensure compliance with regulatory requirements and internal standards.</p><p></p><p><b><br>
About the team:</b></p><p>
The Control Testing Team, within Assurance and Testing, is responsible for completing risk assessments across many of the products, services, and enterprise tools.</p><p></p><p><b><br>
What you will be doing:</b></p><ul><li><p>
Perform control testing and risk assessments related to Data Protection, Network Security, Supplier Management, and Enterprise Risk Management.</p></li><li><p>
Conduct regulatory and compliance assessments, including <b>PCI DSS</b>, <b>NACHA Operating Rules</b>, <b>FedLine/Fedwire</b>, and other FIS‑required assessments.</p></li><li><p>
Evaluate control design and operating effectiveness; document testing results and conclusions in GRC tools.</p></li><li><p>
Identify control gaps, track remediation, and validate corrective action plans.</p></li><li><p>
Support internal audits, regulatory exams, and assurance activities.</p></li><li><p>
Collaborate with business and technology stakeholders to strengthen risk and control environments.</p></li></ul><p></p><p><b>
What you will need:</b></p><ul><li><p>
Bachelor&rsquo;s degree or equivalent work experience.</p></li><li><p>
Strong analytical, organizational, and communication skills.</p></li><li><p>
Experience or familiarity with risk management, control testing, audit, or compliance in a financial services or technology environment preferred.</p></li><li><p>
Ability to manage multiple priorities and work effectively with cross‑functional teams.</p></li><li><p>
Knowledge of network and security technologies.</p></li></ul><p></p><p><b><br>
What we offer you:</b></p><p>
At FIS, you can learn, grow and make an impact in your career. Our benefits include:
</p><ul><li><p>Flexible and creative work environment</p></li><li><p>
Diverse and collaborative atmosphere
</p></li><li><p>Professional and personal development resources</p></li><li><p>
Opportunities to volunteer and support charities</p></li><li><p>
Competitive salary and benefits<br>
</p></li></ul><p></p><br>
<p><b>Privacy Statement</b></p><p></p><p>
FIS is committed to protecting the privacy and security of all personal information that we process in order to provide services to our clients. For specific information on how FIS protects personal information online, please see the Online Privacy Notice.</p><p></p><p><b>
EEOC Statement</b></p><p></p><p>
FIS is an equal opportunity employer. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, marital status, genetic information, national origin, disability, veteran status, and other protected characteristics. The EEO is the Law poster is available here supplement document available here</p><p><br>
For positions located in the US, the following conditions apply. If you are made a conditional offer of employment, you will be required to undergo a drug test. ADA Disclaimer: In developing this job description care was taken to include all competencies needed to successfully perform in this position. However, for Americans with Disabilities Act (ADA) purposes, the essential functions of the job may or may not have been described for purposes of ADA reasonable accommodation. All reasonable accommodation requests will be reviewed and evaluated on a case-by-case basis.</p><p></p><p><b>
Sourcing Model</b></p><p></p><p>
Recruitment at FIS works primarily on a direct sourcing model; a relatively small portion of our hiring is through recruitment agencies. FIS does not accept resumes from recruitment agencies which are not on the preferred supplier list and is not responsible for any related fees for resumes submitted to job postings, our employees, or any other part of our company.</p><p></p><p>
#pridepass</p></div>

Information Security Analyst

RedMatter Solutions

<div>Description:
<p><b>
Position Overview</b></p><p>
We are seeking a Risk, Compliance, and Quality Assurance Specialist to support a large-scale Identity, Credential, and Access Management (ICAM) modernization initiative for a federal customer. This role is responsible for ensuring that modernized identity services and platforms comply with applicable security standards, regulatory requirements, and organizational policies while maintaining high-quality, consistent, and auditable delivery. The specialist will ensure that new capabilities are compliant, secure, and aligned with federal Zero Trust and identity governance objectives.</p>
Requirements:
<p><b>
Key Responsibilities</b></p><h3 class="jobSectionHeader"><b>
Risk &amp; Compliance</b></h3><ul><li>
Ensure modern ICAM solutions comply with federal standards and frameworks (e.g., NIST SP 800-63, FICAM, OMB M-22-09, Zero Trust Architecture guidance)</li><li>
Conduct risk assessments across modern identity platforms, authentication mechanisms, and access controls</li><li>
Identify, document, and track security and compliance risks within the modernized environment; maintain and support the program Risk Register</li><li>
Support ATO processes for modern systems, including control validation, documentation, and audit readiness</li><li>
Evaluate integrations with external identity providers (e.g., login.gov, ID.me, external Entra tenants) for compliance and security risks</li></ul><h3 class="jobSectionHeader"><b>
Quality Assurance &amp; Testing Oversight</b></h3><ul><li>
Establish and enforce QA standards for modern ICAM implementations, including identity lifecycle, federation, and PAM solutions</li><li>
Validate that testing processes (functional, security, integration) meet program and federal requirements</li><li>
Review releases and enhancements to ensure compliance with established quality benchmarks</li><li>
Collaborate with engineering teams to ensure consistent, reliable identity service delivery in the modernized architecture</li></ul><h3 class="jobSectionHeader"><b>
Governance &amp; Policy Alignment</b></h3><ul><li>
Develop and maintain compliance documentation, SOPs, and audit artifacts for the modern ICAM environment</li><li>
Ensure alignment with identity governance policies, including RBAC/ABAC/PBAC models and least privilege principles</li><li>
Support continuous monitoring efforts, including integration with SIEM tools (e.g., Splunk)</li><li>
Provide guidance on policy enforcement across cloud-native and modern identity services=</li></ul><h3 class="jobSectionHeader"><b>
Stakeholder Engagement</b></h3><ul><li>
Work closely with program leadership, security teams, and system owners to ensure compliance and quality objectives are met</li><li>
Support audits, inspections, and reporting activities with federal stakeholders</li><li>
Provide recommendations to improve risk posture and operational maturity of the modernized ICAM solution</li></ul><p><b><br>
Required Qualifications</b></p><ul><li>
7+ years of experience in risk management, compliance, or quality assurance within cybersecurity or ICAM environments</li><li>
Experience supporting federal IT systems and compliance frameworks</li><li>
Demonstrated experience with ATO processes, risk assessments, and audit support</li><li>
Strong understanding of identity and access management concepts, including authentication, authorization, federation, and privileged access</li><li>
Experience working in cloud-based and modern identity environments</li></ul><h3 class="jobSectionHeader"><b>
Required Certification (one of the following):</b></h3><ul><li>
Certified Information Privacy Professional/Government (CIPP/G)</li><li>
Certified Information Systems Auditor (CISA)</li><li>
Certified in Risk and Information Systems Control (CRISC)</li><li>
Certified Information Systems Security Professional (CISSP)</li></ul><p><b><br>
Preferred Qualifications</b></p><ul><li>
Experience supporting ICAM modernization or Zero Trust initiatives</li><li>
Familiarity with FICAM architecture and federal identity mandates</li><li>
Experience with identity governance, lifecycle management, and access certification processes</li><li>
Knowledge of continuous diagnostics and monitoring (CDM) and SIEM integration</li><li>
Strong analytical, documentation, and communication skills</li></ul></div>

Risk, Compliance, and Quality Assurance Specialist – Identity & Access Management Modernization

Search 10000+ Cybersecurity risk analyst jobs near you this April. New roles added regularly across leading industries. Apply today.