cybersecurity risk analyst

cFocus Software Incorporated

<div><h1 class="jobSectionHeader"><b>Vulnerability Analyst II &ndash; Job Description</b></h1><b>
Position Title: </b>Vulnerability Analyst II<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Vulnerability Analyst II provides cybersecurity risk, vulnerability management, and compliance support services in alignment with the SBA Enterprise Cybersecurity Services (ECS) RFQ Task Area 3.5.2. The position supports the SBA Risk Management Framework (RMF), FISMA compliance initiatives, Information System Continuous Monitoring (ISCM), vulnerability management, controls assessment activities, audit support, and continuous monitoring operations across enterprise systems and cloud environments. The analyst performs vulnerability assessments, supports POA&amp;M development, validates security controls, coordinates remediation efforts, and assists Information System Security Officers (ISSOs) and system owners with maintaining compliant and secure systems.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Perform enterprise vulnerability assessments and compliance scans using SBA-approved tools such as Tenable Security Center (SC), Nessus, and Microsoft TVM.</li><li>
Review identified vulnerabilities, assess impact and risk, and provide remediation recommendations for operating systems, applications, network devices, and cloud environments.</li><li>
Support continuous monitoring and Risk Management Framework (RMF) activities in accordance with NIST SP 800-37, NIST SP 800-53 Rev. 5, and NIST SP 800-53A.</li><li>
Assist with the creation, maintenance, and review of cybersecurity documentation including System Security Plans (SSPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&amp;Ms), Configuration Management Plans (CMPs), and contingency documentation.</li><li>
Support control assessments and validation activities by documenting NIST 800-53A Determine If Statements (DISs) and mapping vulnerabilities to applicable controls.</li><li>
Conduct vulnerability scanning activities every 72 hours across workstations, servers, routers, switches, and cloud-based assets in accordance with SBA requirements.</li><li>
Monitor CISA Known Exploited Vulnerabilities (KEV) listings and Binding Operational Directives (BODs) to identify and report emerging risks.</li><li>
Track zero-day vulnerabilities, coordinate remediation activities, and provide ad hoc reporting to leadership and stakeholders.</li><li>
Generate weekly vulnerability reports, dashboards, and briefing materials for ISSOs, system owners, and management.</li><li>
Assist with audit preparation and support activities involving IG, GAO, internal auditors, and external assessors.</li><li>
Maintain scanning infrastructure including scanner deployment, configuration, plugin updates, scan repositories, and vulnerability management SOPs.</li><li>
Support FedRAMP Continuous Monitoring (CONMON) activities by reviewing vulnerability reports and assessing vendor remediation activities.</li><li>
Participate in change management, security operations meetings, and enterprise cybersecurity coordination activities.</li><li>
Ensure all deliverables are complete, accurate, aligned with agency templates, and delivered within required timeframes.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, Information Assurance, or related discipline. Additional years of experience may substitute for degree requirements.</li><li>
3&ndash;6 years of experience supporting vulnerability management, cybersecurity compliance, RMF, or information assurance activities in a federal environment.</li><li>
Experience performing vulnerability assessments and remediation activities using Tenable SC/Nessus or equivalent tools.</li><li>
Knowledge of FISMA, NIST RMF, NIST SP 800-53 Rev. 5, NIST SP 800-53A, NIST SP 800-137, and related federal cybersecurity standards.</li><li>
Experience supporting POA&amp;M management, security assessments, continuous monitoring, and audit response activities.</li><li>
Working knowledge of Windows, Linux/Unix, network infrastructure, cloud platforms, and enterprise security technologies.</li><li>
Strong written and verbal communication skills with the ability to produce technical documentation and executive-level reports.</li><li>
Ability to analyze security findings, prioritize risks, and coordinate remediation with technical stakeholders.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
CompTIA Security+</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
Certified Ethical Hacker (CEH)</li><li>
GIAC Security Certifications (GSEC, GPEN, or similar)</li><li>
Tenable Certified Professional or equivalent vulnerability management certification</li></ul><p>
</p><p>Gupkg0JOaj</p></div>

SBA - Vulnerability Analyst II

Rivian

<div><div>The Cybersecurity Analyst &ndash; Risk Management is a mid-career individual contributor supporting Rivian&rsquo;s cybersecurity risk management practice. This role involves day-to-day management of cybersecurity risks, monitoring key risk indicators (KRIs), and facilitating risk discussions with technology and business stakeholders.</div><div></div><div><br>
The analyst will leverage Rivian&rsquo;s risk platforms and AI-enabled tooling to improve efficiency, transparency, and defensibility of risk decisions. This role sits within Enterprise Cybersecurity on the Cybersecurity Risk Management team and partners closely with the Cyber Third-Party Risk Management (TPRM) lead, security engineering teams, and other functions.</div><br>
<ul><li>
Risk Register Ownership: Maintain and continuously improve the cybersecurity and crown-jewel risk registers, ensuring risks are clearly defined, scored, prioritized, and kept current.</li><li>
Track risk status from identification through treatment and closure, including documenting decisions, owners, due dates, dependencies, and evidence.</li><li>
Design, implement, and monitor KRIs and related metrics, such as control health, incident trends, and assessment throughput, to provide an objective view of risk posture.</li><li>
Meet regularly with risk owners and functional leaders to gather updates, validate assumptions, and align on risk treatment plans and progress.</li><li>
Evaluate how risks propagate across systems, suppliers, processes, and programs; surface second-order and cascading impacts in risk narratives and dashboards.</li><li>
Collaborate with the Cyber TPRM lead where responsibilities intersect, including supplier-driven risks, concentration risk, and systemic control gaps, to ensure consistent risk assessment and treatment.</li><li>
Help facilitate workshops and review sessions with business and technology leaders to clarify risk scenarios, tradeoffs, and treatment options.</li><li>
Use Rivian&rsquo;s risk platform and AI-enabled tools to improve efficiency, effectiveness, and expediency in risk logging, analysis, reporting, and communication.</li><li>
Maintain and evolve a Cybersecurity Risk Dashboard that provides an accurate, near real-time view of key risks, KRIs, and trends for leadership and governance forums.</li><li>
Apply NIST CSF and ISO 27001 concepts when assessing controls, documenting risks, and proposing treatments, helping ensure consistency with the ISMS and enterprise risk practices.</li><li>
Identify gaps and friction in current risk processes and propose practical improvements to increase clarity, adoption, and impact.</li></ul><div><b><br>
Minimum Qualifications</b></div><ul><li>
5+ years of combined experience in cybersecurity, technology risk, enterprise risk management, or related fields.</li><li>
At least 3 years with primary responsibility for leading or owning a risk management function, program, or risk domain within an organization.</li><li>
Hands-on experience maintaining and operating risk registers and risk management tooling, including GRC, IRM, or dedicated risk platforms.</li><li>
Working knowledge of the NIST Cybersecurity Framework (CSF) and exposure to frameworks such as ISO/IEC 27001, including risk assessment/treatment concepts and control alignment.</li><li>
Demonstrated ability to influence risk treatment decisions, not just document them, by framing options, tradeoffs, and business impact for stakeholders.</li><li>
Strong analytical and quantitative risk skills, including building KRIs, basic risk modeling, scenario comparison, and trend analysis.</li><li>
High comfort working with AI tools for analysis, synthesis, workflow automation, and responsible experimentation to improve risk processes.</li><li>
Excellent written and verbal communication skills with the ability to translate complex technical risks into concise, business-relevant narratives.</li><li>
Proven ability to work cross-functionally, build trust with stakeholders, and facilitate productive discussions in ambiguous situations.</li></ul><div><b>
Preferred Qualifications</b></div><ul><li>
Experience with modern GRC/IRM or dedicated risk platforms and building risk dashboards for security leadership.</li><li>
Professional certifications such as CRISC, PMI-RMP, CISM, or similar.</li><li>
Experience in fast-paced, high-growth environments such as technology, automotive, or manufacturing, where speed, agility, and rigor are required.</li></ul></div>

Staff Cybersecurity Analyst, Risk Management

Stellar Hunters

<div><h4 class="jobSectionHeader"><b>Job Summary</b></h4>
<p>
We are seeking a Cyber GRC Specialist to support and advance the company&rsquo;s cybersecurity governance, risk management, and compliance (GRC) initiatives. The successful candidate will collaborate with Security, IT, Legal, Privacy, Compliance, and business teams to identify and manage cyber risk, implement controls, maintain compliance with applicable frameworks and regulations, and support continuous improvement of the security posture. This role requires a pragmatic, consultative approach and the ability to translate technical security concepts into business risk terms.</p>
<h4 class="jobSectionHeader"><b>Key Responsibilities</b></h4>
<h5 class="jobSectionHeader"><b>Governance &amp; Policy</b></h5>
<ul>
<li><p>Develop, maintain, and operationalize cybersecurity policies, standards, and procedures aligned with industry frameworks and regulatory requirements (e.g., NIST CSF, ISO 27001, SOC 2, PCI, relevant regional regulations).</p></li>
<li><p>Support security governance forums and reporting to senior leadership and stakeholders on cyber risk, control effectiveness, and remediation progress.</p></li>
<li><p>Collaborate with cross-functional teams to ensure security requirements are integrated into business processes, projects, and third-party relationships.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Risk Management &amp; Assessments</b></h5>
<ul>
<li><p>Conduct and coordinate risk assessments, control gap analyses, and threat/risk modeling for systems, applications, and third-party services.</p></li>
<li><p>Maintain the risk register, prioritize remediation activities, and track closure of identified vulnerabilities and control deficiencies.</p></li>
<li><p>Perform vendor security and risk assessments; review third-party contracts and recommend appropriate security controls and contractual language.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Compliance &amp; Audit Support</b></h5>
<ul>
<li><p>Support internal and external compliance initiatives, audits, and certifications (e.g., SOC 2, ISO 27001), including evidence collection, control testing, and remediation coordination.</p></li>
<li><p>Monitor regulatory and industry compliance requirements and translate obligations into practical control and process requirements across the organization.</p></li>
<li><p>Prepare and maintain documentation, control narratives, and artifacts required for assessments and regulatory inquiries.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Incident Response &amp; Continuous Improvement</b></h5>
<ul>
<li><p>Participate in incident response planning and post-incident reviews; advise on control improvements and regulatory/contractual notification considerations.</p></li>
<li><p>Collaborate with Security Operations and IT teams to ensure controls are effectively implemented, monitored, and improved based on lessons learned and evolving threats.</p></li>
<li><p>Identify opportunities to automate control monitoring, reporting, and GRC workflows using GRC platforms and security tooling.</p></li>
</ul>
<h5 class="jobSectionHeader"><b>Training, Awareness &amp; Advisory</b></h5>
<ul>
<li><p>Develop and deliver role-based security awareness, GRC guidance, and targeted training for employees, contractors, and business partners.</p></li>
<li><p>Provide practical, risk-based advisory to Product, Engineering, IT, and business teams on secure design, control selection, and compliance requirements.</p></li>
<li><p>Act as a trusted advisor for security and compliance questions related to new projects, cloud deployments, and third-party integrations.</p></li>
</ul>
<h4 class="jobSectionHeader"><b>Required Qualifications - Skills &amp; Experience</b></h4>
<ul>
<li><p>Bachelor&rsquo;s degree in Information Security, Computer Science, Cybersecurity, Risk Management, or a related field, or equivalent practical experience.</p></li>
<li><p>3+ years of demonstrated experience in cybersecurity GRC, risk management, compliance, or related roles within a commercial or regulated environment.</p></li>
<li><p>Familiarity with common cybersecurity frameworks and standards (e.g., NIST CSF, ISO 27001, SOC 2) and practical experience applying them.</p></li>
<li><p>Experience performing risk assessments, vendor/security assessments, control gap analysis, and supporting audits or certifications.</p></li>
<li><p>Working knowledge of cloud security concepts (AWS, Azure, GCP), identity and access management, and common security controls.</p></li>
<li><p>Strong written and verbal communication skills with the ability to document controls, prepare executive reports, and communicate with technical and non-technical stakeholders.</p></li>
<li><p>Experience with GRC platforms, ticketing systems, and security assessment tools; comfortable working in cross-functional, fast-paced environments.</p></li>
</ul>
<h4 class="jobSectionHeader"><b>Preferred Qualifications</b></h4>
<ul>
<li><p>Relevant certifications such as CISSP, CISM, CRISC, CGEIT, or certification in GRC platforms preferred.</p></li>
<li><p>Experience supporting SOC 2, ISO 27001, or other compliance programs and working with external auditors.</p></li>
<li><p>Prior exposure to privacy requirements and data protection interactions with cybersecurity controls is a plus.</p></li>
<li><p>Experience in cloud-native environments, DevSecOps practices, and automation of control monitoring is advantageous.</p></li>
</ul>
<h4 class="jobSectionHeader"><b>Work Environment &amp; Compensation</b></h4>
<ul>
<li><p>Full-time role with a hybrid onsite/remote work model; occasional travel may be required for stakeholder meetings, audits, or vendor engagements.</p></li>
<li><p>Competitive salary commensurate with experience and a comprehensive benefits package, including health insurance, retirement plan options, and paid time off.</p></li>
<li><p>Opportunities for professional development, certification support, and career progression within Security, Compliance, and Risk functions.</p></li>
<li><p>Inclusive and respectful workplace culture that values diversity, equity, and work-life balance.</p></li></ul></div>

Cyber GRC Specialist

True Anomaly

<div><div><p>Space is a warfighting domain. True Anomaly seeks those with the talent and ambition to build the technology that secures it.</p>
<p>
OUR MISSION</p>
<p>
True Anomaly delivers decisive capabilities for space superiority. We build autonomous spacecraft, advanced payloads, mission software, and space-based interceptors &mdash; enabling the U.S. and its Allies to secure the space environment and counter threats from the ultimate high ground.</p>
<p>
OUR VALUES</p>
<ul>
<li><b>Be the offset.</b> We create asymmetric advantages with creativity and ingenuity.</li>
<li><b>What would it take?</b> We challenge assumptions to deliver ambitious results.</li>
<li><b>It&rsquo;s the people.</b> Our team is our competitive advantage and we are better together.</li>
</ul></div><div><p><b>
Your Mission</b></p>
<p>
We are seeking a driven and detail-oriented Enterprise Risk Analyst to support two distinct but interconnected lines of effort: Enterprise Risk Management (ERM) and Third-Party Vendor Risk Management (TPVRM). Reporting to the Senior Enterprise Risk Manager, you will play a hands-on role in executing risk assessments, maintaining program documentation, tracking remediation activities, and building the data foundation that powers executive-level risk decision-making.</p>
<p>
This role is ideal for a mid-career risk professional who is fluent in frameworks such as NIST RMF and CMMC, is developing practical experience with risk quantification methodologies like FAIR and OCTAVE, and is eager to grow within a fast-paced aerospace and defense SaaS environment. You will work closely with engineering, security, legal, compliance, and operations teams to help identify, document, and track risk across the enterprise and its third-party supply chain.</p><br>
<p></p>
<p><b>
Responsibilities:</b></p><br>
<p></p>
<p><b>
Enterprise Risk Management</b></p>
<ul>
<li>Support the design, execution, and continuous improvement of the enterprise risk management program under the direction of the Senior Enterprise Risk Manager.</li>
</ul><ul><li>Assist in conducting structured risk assessments using OCTAVE or similar threat-and-asset-centric methodologies, documenting findings, threat profiles, and recommended mitigations.</li>
</ul><ul><li>Support the application of FAIR methodology to help quantify risks in financial terms and contribute to risk prioritization analyses for leadership.</li>
</ul><ul><li>Maintain and update the enterprise risk register, ensuring accuracy of risk ratings, ownership assignments, remediation status, and residual risk tracking.</li>
</ul><ul><li>Build and maintain program dashboards, KPI/KRI reports, and status tracking using tools such as Jira, Confluence, enterprise GRC platforms, and MS Project.</li>
</ul><ul><li>Assist with audit readiness activities including evidence collection, pre-assessment preparation, control documentation, and post-audit remediation tracking.</li>
</ul><ul><li>Support POA&amp;M management for IL5 and IL6 environments, tracking open items to closure and escalating blockers to the Enterprise Risk Manager.</li>
</ul><ul><li>Contribute to the development and maintenance of risk policies, standards, and guidelines aligned to NIST SP 800-53 Rev. 5, NIST SP 800-171, RMF, and CMMC Level 3.</li>
</ul><ul><li>Coordinate and track internal audit schedules, findings, and corrective action plans across business units.</li>
</ul>
<p><b>Third-Party Vendor Risk Management</b></p>
<ul>
<li>Execute vendor risk assessments as part of the onboarding and periodic review lifecycle, including security questionnaire administration, documentation review, and risk scoring.</li>
</ul><ul><li>Maintain the vendor risk inventory and lifecycle tracking records, ensuring all vendors are appropriately tiered and assessed on schedule.</li>
</ul><ul><li>Monitor vendor risk signals including cybersecurity advisories, regulatory actions, and contractual compliance status, escalating material changes to the Enterprise Risk Manager.</li>
</ul><ul><li>Support contract and procurement teams by providing vendor risk assessment findings and recommended risk mitigation language.</li>
</ul><ul><li>Assist in ensuring TPVRM program alignment with CMMC supply chain requirements, DFARS clauses, and ITAR/export control considerations for critical suppliers.</li>
</ul><ul><li>Develop and maintain vendor risk reporting inputs and dashboard content to support executive-level visibility into third-party risk exposure.</li>
</ul>
<p><b>Cross-Functional Collaboration</b></p>
<ul>
<li>Serve as a reliable day-to-day point of contact for risk-related inquiries from internal stakeholders across engineering, security, operations, and legal teams.</li>
</ul><ul><li>Track program milestones, action items, and deliverables, proactively communicating status and flagging risks or dependencies to the Enterprise Risk Manager.</li>
</ul><ul><li>Continuously improve risk program workflows, documentation templates, and reporting processes to support scalable and repeatable execution.</li>
</ul><ul><li>Support the preparation of materials for internal leadership briefings, external assessor interactions, and government partner reviews.</li></ul><br>
<p></p>
<p><b>
Qualifications</b></p>
<ul>
<li><b>5+ years</b> of experience in enterprise risk management, GRC, cybersecurity risk, compliance, or a closely related discipline.</li>
</ul><ul><li>Working knowledge of NIST SP 800-53, NIST SP 800-171, DoD RMF (IL5/IL6), and CMMC, with direct experience supporting assessments or audits under one or more of these frameworks.</li>
</ul><ul><li>Familiarity with risk assessment methodologies including FAIR and/or OCTAVE, with a desire to deepen applied expertise in risk quantification.</li>
</ul><ul><li>Experience supporting or executing third-party/vendor risk assessments, including questionnaire administration, documentation review, and risk tracking.</li>
</ul><ul><li>Hands-on experience with program management and GRC documentation tools including Jira, Confluence (Atlassian suite), MS Project, enterprise GRC platforms, and MS Visio or Lucidchart.</li>
</ul><ul><li>Strong written and verbal communication skills, with the ability to clearly document findings and translate risk concepts for both technical and non-technical audiences.</li>
</ul><ul><li>Highly organized, self-directed, and comfortable managing multiple workstreams simultaneously in a fast-paced, regulated environment.</li>
</ul><ul><li>Active or ability to obtain <b>SECRET</b>, <b>TS/SCI security clearance</b>.</li>
</ul><ul><li>Must be a U.S. citizen, lawful permanent resident, or protected individual per ITAR requirements (8 U.S.C. 1324b(a)(3)).</li></ul><br>
<p></p>
<p><b>
Preferred Qualifications</b></p>
<ul>
<li>Background in startup, aerospace, defense technology, or SaaS companies operating in regulated government markets.</li>
</ul><ul><li>Industry certifications such as:</li>
</ul><ul><li>Certified in Risk and Information Systems Control (CRISC)</li>
</ul><ul><li>Certified Information Systems Auditor (CISA)</li>
</ul><ul><li>Open FAIR Certification (The Open Group)</li>
</ul><ul><li>CompTIA Security+ or equivalent</li>
</ul><ul><li>Certified ScrumMaster (CSM) or similar Agile certification</li>
</ul><ul><li>Experience with cloud environments, particularly Azure Government and/or AWS GovCloud.</li>
</ul><ul><li>Familiarity with POA&amp;M management, SSP documentation, and audit evidence collection in DoD authorization contexts.</li>
</ul><ul><li>Working knowledge of ITAR, EAR, DFARS, and export control considerations as they relate to vendor and supply chain risk.</li>
</ul><ul><li>Familiarity with Agile/Scrum and hybrid project delivery models.</li></ul><br>
<p></p>
<p><b>
Compensation</b></p>
<ul>
<li><b>Base Salary:</b> Denver - $115,000 to $155,000, Long Beach - $120,000 to $165,000, Washington, DC - $120,000 to $165,000</li>
</ul><ul><li><b>Equity + Benefits</b> including Health, Dental, Vision, HRA/HSA options, PTO and paid holidays, 401K, Parental Leave</li>
</ul>
<p><i>Your actual level and base salary will be determined on a case-by-case basis and may vary based on the following considerations: job-related knowledge and skills, education, location, and experience.</i></p><br>
<p></p>
<p><b>
Additional Requirements</b></p>
<ul>
<li><b>Work Location:</b> This role will be onsite at one of our office locations: Centennial, CO, Long Beach, CA, or Washington, DC <b>#LI-Onsite</b></li>
</ul><ul><li><b>Work Environment:</b> Standard office setting, working at a desk or in a production factory environment</li>
</ul><ul><li><b>Physical Demands:</b> May include frequent standing, sitting, walking, bending, and lifting or carrying items up to 20 lbs.</li></ul><br>
<p></p>
<p><i>
This position will be open until it is successfully filled.</i></p>
<p>
To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR), you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.</p>
<p>
We value diversity of experience, knowledge, backgrounds, and perspectives and harness these qualities to create extraordinary impact. True Anomaly is committed to equal employment opportunity regardless of sex, race, religion or belief, ethnic or national origin, disability, age, citizenship, marital, domestic or civil partnership status, sexual orientation, gender identity, pregnancy, maternity or related condition (including breastfeeding) or any other basis as protected by applicable law. If you have a disability or additional need that requires accommodation, please do not hesitate to let us know.</p></div><p></p><div><p><br>
To conform to U.S. Government space technology export regulations, including the International Traffic in Arms Regulations (ITAR) you must be a U.S. citizen, lawful permanent resident of the U.S., protected individual as defined by 8 U.S.C. 1324b(a)(3), or eligible to obtain the required authorizations from the U.S. Department of State.</p>
<p>
True Anomaly is committed to equal employment opportunity on any basis protected by applicable state and federal laws. If you have a disability or additional need that requires accommodation, please do not hesitate to let us.</p></div></div><p></p>

Enterprise Risk Analyst

Barclays

<div><div><p>Date live: 05/07/2026</p>
 <p>Business Area: Risk</p>
 <p>Area of Expertise: Risk and Quantitative Analytics</p>
 <p>Contract: Permanent</p>
 <p>Reference Code: JR-0000089145</p></div></div>
<br><div><p>Embark on a transformative journey at Barclays as an Operational Risk Cyber Specialist. In this role, you&rsquo;ll lead insightful reviews and investigations into the Operational Risk aspects of specific risk categories across the bank. Drawing on your expertise in Security Architecture and conducting risk assessments, you&rsquo;ll identify vulnerabilities and recommend strategic enhancements to safeguard critical assets. Your experience across domains such as application security, network security, cloud security, and security operations will be essential in evaluating emerging threats and ensuring robust alignment with Barclays' Operational Risk Framework, Policies, and Standards.</p>
<p></p><p>To be successful as an Operational Risk Cyber Specialist, you should have:</p>
<p></p><ul><li><p>Designing and implementing security architecture frameworks</p>
</li><li><p>Performing detailed and methodical risk assessments across various domains</p>
</li><li><p>Application security, network security, cloud security and security operations</p>
</li><li><p>Communicating multi-faceted security topics to technical and non-technical audiences</p>
</li></ul><p></p><p>Other highly valued skills include:</p>
<p></p><ul><li><p>Experience in technical cyber roles, ideally demonstrating capability across different fields within Cyber</p>
</li><li><p>Working experience with common Frameworks such as NIST CSF, ISO 27001; ideally experience in Banking, or other regulated industry</p>
</li><li><p>CISSP, CISM or similar qualifications would be helpful but not required</p>
</li></ul><p></p><p>This role is located in Whippany, NJ.</p>
<p></p><p>Minimum Salary: $75,000</p>
<p>Maximum Salary: $100,000</p>
<p></p><p>The minimum and maximum salary/rate information above includes only base salary or base hourly rate. It does not include any other type of compensation or benefits that may be available.</p>
<p></p><p>Barclays employees are eligible for a suite of competitive and generous employee benefits, including medical, dental and vision coverage, 401(k), life insurance, and other paid leave for qualifying circumstances.</p>
<p></p><p>This position is eligible for an incentive award.</p>
<p><b>Purpose of the role</b></p>
<p>To provide independent review and challenge of the Operational Risk elements of particular risk categories across the bank. Ensuring they are carried out in accordance with Barclays Operational Risk Framework, Policies, and Standards</p>
<p></p><p><b>Accountabilities</b></p>
<ul><li>Risk identification and proactive risk management, identifying interconnected, horizon and emerging risks to assist the business in understanding, managing and mitigating the right risks in line with their business strategy and objectives.</li>
<li>Analysis of operational risk data to identify trends, patterns, and emerging risks.</li>
<li>Risk-based analysis of business processes, systems, and controls to assess the likelihood and impact of identified risks.</li>
<li>Ongoing research and monitoring of internal and external sources to identify potential Operational Risks.</li>
<li>Oversight, review and challenge of 1st Line activities including - Risk Control Self Assessments (RCSAs), Risk Events, Issues and attendance at key Risk and Control meetings (with associated reporting) ensuring they accurately reflect the business risk position,.</li>
<li>Stakeholder management, engaging and working effectively with First and Second Line management.</li>
<li>Risk based 2nd Line input into 1st Line Projects, Initiatives and Strategic decision making.</li>
</ul><p></p><p><b>Analyst Expectations</b></p>
<ul><li>To perform prescribed activities in a timely manner and to a high standard consistently driving continuous improvement.</li>
<li>Requires in-depth technical knowledge and experience in their assigned area of expertise</li>
<li>Thorough understanding of the underlying principles and concepts within the area of expertise</li>
<li>They lead and supervise a team, guiding and supporting professional development, allocating work requirements and coordinating team resources.</li>
<li>If the position has leadership responsibilities, People Leaders are expected to demonstrate a clear set of leadership behaviours to create an environment for colleagues to thrive and deliver to a consistently excellent standard. The four LEAD behaviours are: L &ndash; Listen and be authentic, E &ndash; Energise and inspire, A &ndash; Align across the enterprise, D &ndash; Develop others.</li>
<li>OR for an individual contributor, they develop technical expertise in work area, acting as an advisor where appropriate.</li>
<li>Will have an impact on the work of related teams within the area.</li>
<li>Partner with other functions and business areas.</li>
<li>Takes responsibility for end results of a team&rsquo;s operational processing and activities.</li>
<li>Escalate breaches of policies / procedure appropriately.</li>
<li>Take responsibility for embedding new policies/ procedures adopted due to risk mitigation.</li>
<li>Advise and influence decision making within own area of expertise.</li>
<li>Take ownership for managing risk and strengthening controls in relation to the work you own or contribute to. Deliver your work and areas of responsibility in line with relevant rules, regulation and codes of conduct.</li>
<li>Maintain and continually build an understanding of how own sub-function integrates with function, alongside knowledge of the organisations products, services and processes within the function.</li>
<li>Demonstrate understanding of how areas coordinate and contribute to the achievement of the objectives of the organisation sub-function.</li>
<li>Make evaluative judgements based on the analysis of factual information, paying attention to detail.</li>
<li>Resolve problems by identifying and selecting solutions through the application of acquired technical experience and will be guided by precedents.</li>
<li>Guide and persuade team members and communicate complex / sensitive information.</li>
<li>Act as contact point for stakeholders outside of the immediate function, while building a network of contacts outside team and external to the organisation.</li>
</ul><p></p><p>All colleagues will be expected to demonstrate the Barclays Values of Respect, Integrity, Service, Excellence and Stewardship &ndash; our moral compass, helping us do what we believe is right. They will also be expected to demonstrate the Barclays Mindset &ndash; to Empower, Challenge and Drive &ndash; the operating manual for how we behave.</p></div>

Operational Risk Cyber Specialist

Tikal Group Doha

<p>Job Opportunity: Cybersecurity Analyst</p><p><b>Location:</b> Doha, Qatar<br/><b>Company:</b> Tikal Group Doha</p><p>About Us</p><p>Tikal Group Doha is a technology solutions provider specializing in secure systems integration, IT infrastructure, and digital transformation. We are committed to protecting businesses against evolving cyber threats and ensuring the highest standards of data security. As we expand, we are seeking a skilled <b>Cybersecurity Analyst</b> to strengthen our security operations and safeguard our digital assets.</p><p>Role Overview</p><p>The <b>Cybersecurity Analyst</b> will be responsible for monitoring, analyzing, and responding to security incidents, ensuring compliance with regulatory standards, and proactively identifying vulnerabilities. This role requires technical expertise, analytical skills, and the ability to collaborate across teams to maintain a secure IT environment.</p><p>Key Responsibilities</p><ul><li>Monitor and analyze security alerts, logs, and incidents.</li><li>Conduct vulnerability assessments and penetration testing.</li><li>Investigate and respond to cybersecurity threats and breaches.</li><li>Implement and maintain security tools, firewalls, and intrusion detection systems.</li><li>Ensure compliance with Qatari regulations and international cybersecurity standards.</li><li>Collaborate with IT teams to strengthen system defenses and patch vulnerabilities.</li><li>Prepare reports and recommendations for management on security posture.</li><li>Stay updated on emerging threats, trends, and best practices in cybersecurity.</li></ul><p>Qualifications</p><ul><li>Bachelor&rsquo;s degree in Cybersecurity, Information Technology, Computer Science, or related field.</li><li>2&ndash;5 years of experience in cybersecurity analysis or IT security.</li><li>Strong knowledge of security frameworks (ISO 27001, NIST, CIS).</li><li>Proficiency in SIEM tools, firewalls, and endpoint protection systems.</li><li>Experience with incident response, vulnerability management, and risk assessment.</li><li>Excellent problem-solving, analytical, and communication skills.</li><li>Ability to thrive in a fast-paced, multicultural environment.</li></ul><p>Why Join Us?</p><ul><li>Be part of a growing cybersecurity team in Doha.</li><li>Play a key role in protecting Tikal Group Doha&rsquo;s digital infrastructure.</li><li>Competitive salary and benefits package.</li><li>Opportunities for professional development and career advancement.</li><li>Supportive, innovation-driven, and security-focused work culture.</li></ul><p>Pay: Up to QAR35,000.00 per month</p><p>Work Location: In person</p>

Cybersecurity Analyst

<div><h1 class="jobSectionHeader"><b>Cyber Threat Intelligence Analyst Job Description</b></h1><b>
Position: </b>Cyber Threat Intelligence Analyst<br>
<b>Program: </b>SBA Enterprise Cybersecurity Services (ECS)<h2 class="jobSectionHeader"><b>
Position Summary</b></h2>
The Cyber Threat Intelligence Analyst supports the Small Business Administration (SBA) Enterprise Cybersecurity Services (ECS) program by delivering advanced cyber threat intelligence, threat analysis, proactive threat hunting, and operational cybersecurity support services.<br>
The Cyber Threat Intelligence Analyst is responsible for collecting, analyzing, correlating, and disseminating actionable cyber threat intelligence to support the SBA Security Operations Center (SOC), cybersecurity operations, incident response activities, and enterprise risk mitigation efforts. The position supports 24x7x365 cybersecurity operations through advanced analysis of indicators of compromise (IOCs), adversary tactics, techniques, and procedures (TTPs), emerging vulnerabilities, and threat actor activity impacting federal information systems and cloud environments.<h2 class="jobSectionHeader"><b>
Essential Duties and Responsibilities</b></h2><ul><li>
Provide cyber threat intelligence and operational analysis support for the SBA SOC in support of Task Area 3.5.3 Cybersecurity Operations Support.</li><li>
Conduct proactive cyber threat hunting activities across enterprise systems, cloud environments, endpoints, and network infrastructure.</li><li>
Analyze indicators of compromise (IOCs), threat actor tactics, techniques, and procedures (TTPs), malware behaviors, and emerging cyber threats.</li><li>
Monitor and evaluate cyber threat intelligence feeds, vendor reporting, CISA advisories, US-CERT alerts, and external intelligence sources.</li><li>
Perform advanced correlation and analysis of security events, SIEM data, IDS/IPS alerts, EDR telemetry, DNS logs, firewall logs, and network traffic.</li><li>
Support incident response and cybersecurity investigations through intelligence-driven analysis and threat attribution support.</li><li>
Develop cyber threat intelligence reports, operational briefings, situational awareness products, and executive-level summaries.</li><li>
Assist with the identification of previously unknown attack vectors and suspicious activity through threat hunting and anomaly analysis.</li><li>
Support digital forensics and incident analysis activities in coordination with SOC analysts, engineers, and incident responders.</li><li>
Develop and maintain threat intelligence playbooks, threat models, attack scenarios, and adversary profiles.</li><li>
Perform analysis of cloud security events and cyber threats impacting Microsoft 365, Azure, AWS, Salesforce, and hybrid cloud environments.</li><li>
Conduct research on advanced persistent threats (APTs), ransomware groups, insider threats, nation-state actors, and emerging cyber attack trends.</li><li>
Provide recommendations for defensive countermeasures, detection logic improvements, and enhanced security monitoring capabilities.</li><li>
Assist in the development of threat signatures, SIEM use cases, detection analytics, and threat detection content.</li><li>
Support continuous improvement of cybersecurity operations, threat intelligence workflows, and incident response processes.</li><li>
Coordinate with federal stakeholders, law enforcement, privacy officials, insider threat teams, and mission partners during cyber incident activities.</li><li>
Document investigative findings, intelligence assessments, and operational actions within case management and reporting systems.</li><li>
Participate in SOC operational meetings, shift briefings, incident coordination calls, and cybersecurity readiness activities.</li><li>
Maintain awareness of evolving cybersecurity technologies, federal threat reporting requirements, and NIST cybersecurity guidance.</li><li>
Support cybersecurity communications, intelligence sharing, and collaboration activities across the SBA enterprise.</li></ul><h2 class="jobSectionHeader"><b>
Minimum Qualifications</b></h2><ul><li>
Bachelor&rsquo;s degree in Cybersecurity, Computer Science, Information Technology, Intelligence Studies, Information Assurance, or related discipline. Relevant experience may substitute for degree requirements.</li><li>
Minimum of 5 years of experience supporting cybersecurity operations, cyber threat intelligence, threat hunting, incident response, or SOC operations.</li><li>
Experience analyzing threat intelligence, indicators of compromise, adversary TTPs, and cybersecurity attack methodologies.</li><li>
Hands-on experience with SIEM, EDR, IDS/IPS, network analysis, and cyber defense tools.</li><li>
Experience conducting threat hunting and advanced event correlation across enterprise environments.</li><li>
Knowledge of federal cybersecurity frameworks and guidance including NIST SP 800-61, NIST SP 800-53, and CISA operational guidance.</li><li>
Understanding of MITRE ATT&amp;CK framework and cyber kill chain methodologies.</li><li>
Experience with cloud security monitoring and threat analysis in Microsoft Azure, AWS, Microsoft 365, and hybrid environments.</li><li>
Strong analytical, investigative, communication, and reporting skills.</li><li>
Ability to support 24x7x365 cybersecurity operational environments.</li></ul><h2 class="jobSectionHeader"><b>
Preferred Certifications</b></h2><ul><li>
GIAC Cyber Threat Intelligence (GCTI)</li><li>
GIAC Certified Incident Handler (GCIH)</li><li>
GIAC Certified Forensic Analyst (GCFA)</li><li>
Certified Information Systems Security Professional (CISSP)</li><li>
CompTIA CySA+</li><li>
Certified Ethical Hacker (CEH)</li><li>
Splunk Enterprise Security Certified Admin</li><li>
Microsoft Security Operations Analyst Associate (SC-200)</li></ul><p>
</p><p>Pw75tUj9Bf</p></div>

SBA - Cyber Threat Intelligence Analyst

Search 7397+ Cybersecurity risk analyst jobs near you this May. New roles added regularly across leading industries. Apply today.