> Markdown version of [/jobs/ext/4398743-information-security-risk-analyst-ii](https://www.wearedevelopers.com/jobs/ext/4398743-information-security-risk-analyst-ii). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Security Risk Analyst II

- **Company:** U.S. Bank, National Association
- **Location:** Sandy Springs, GA, United States
- **Experience:** Experienced
- **Salary:** $105,400.0 - $124,000.0
- **Contract:** Permanent contract
- **Skills:** Cyber Security, Identity and Access Management, Network Security, Enterprise Software Applications, Software Security, Servicenow
- **Published:** October 19, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=0b9d15b3e670d082

## About the Role

* Five or more years of experience in information security, cybersecurity risk management, compliance, or a related technical security discipline.
 * Experience performing information security risk analysis or assessments.
 * Experience evaluating security findings and determining technical and business impact.
 * Knowledge of enterprise applications, infrastructure, security controls, and defense-in-depth concepts.
 * Experience owning security findings, risk records, issues, or remediation activities through resolution.
 * Strong analytical, investigative, and critical-thinking skills.
 * Ability to identify root causes and evaluate control effectiveness.
 * Strong written and verbal communication skills.
 * Ability to explain technical risks to both technical and nontechnical stakeholders.
 * Experience influencing stakeholders and driving outcomes across multiple teams or business lines.
 * Ability to work independently, manage competing priorities, and take accountability for decisions.
 * A technical security foundation that supports credible risk analysis.

Nice to Have Skills:

 * ServiceNow IRM experience.
 * Archer GRC experience.
 * Experience with other GRC or enterprise risk management platforms.
 * Information security governance or compliance experience.
 * Issues management and corrective action plan experience.
 * Enterprise control framework knowledge.
 * Experience participating in platform migrations or large transformation initiatives.
 * Technical experience in IAM, infrastructure security, network security, application security, or security engineering.
 * Experience facilitating cross-functional remediation and risk discussions
 * CRISC, CISA, CISSP, other security specific certs

Based Skills/Experience:

 * Typically a Bachelor's degree, or equivalent work experience
 * Typically three to five years of relevant experience
 * Effective communication and collaboration skills
 * Ability to articulate complex technical issues in a clear and concise manner

## Description

* Evaluate security observations to determine legitimacy, severity, business impact, and appropriate risk treatment.
 * Analyze application architectures, infrastructure environments, security controls, and defense-in-depth strategies.
 * Manage a portfolio of active security findings through the full risk lifecycle.
 * Map findings to applicable security policies, standards, controls, and business ownership.
 * Identify the appropriate application or technology owners responsible for remediation.
 * Partner with remediation owners to develop and execute corrective action plans.
 * Evaluate root causes, control effectiveness, and the adequacy of proposed remediation.
 * Translate technical security issues into clear business and technology risk.
 * Maintain accurate risk documentation and lifecycle governance through closure.
 * Facilitate cross-functional discussions involving application, technology, security, and business stakeholders.
 * Contribute to testing and validation of the findings management system, supporting efficient findings management and process enhancements.
 * Work independently on complex security risk scenarios with minimal oversight.