> Markdown version of [/jobs/ext/4668290-information-security-risk-analyst](https://www.wearedevelopers.com/jobs/ext/4668290-information-security-risk-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Information Security Risk Analyst

- **Company:** Stellar Professionals
- **Location:** Raleigh, NC, United States (Remote available)
- **Experience:** Experienced
- **Contract:** Contract
- **Skills:** Cyber Security, Identity and Access Management, Network Security
- **Published:** November 11, 2026
- **Apply:** https://www.dice.com/job-detail/4bdda417-a450-4064-b3f5-0925d788f1fe

## About the Role

* NIST & Compliance Frameworks: 3+ years of hands-on experience applying NIST SP 800-53, SP 800-30, and SP 800-37 guidelines.
 * Vendor Risk Auditing: 3+ years of experience conducting vendor interviews, evaluating technical evidence, and generating risk registry reports.
 * Security Technologies: 5+ years of experience with mainstream operating systems, identity and access management (IAM), network security appliances, and cryptography.
 * Education: Bachelor's degree with 2+ years of IT security experience, Associate degree with 3+ years, or equivalent experience.

< data-path-to-node="18" dir="ltr">Preferred Qualifications

 * Industry professional certifications (CISSP, CISM, or equivalent).
 * Experience evaluating against NIST Cybersecurity Framework (CSF) or HITRUST standards.

## Description

Seeking a Mid-Level Information Security Risk Analyst to lead annual Third-Party Risk Assessments (TPA) for technical implementation vendors based on state security standards. Operating alongside a lead analyst, this position owns the delivery of system and data inventories, risk registries, and Risk Assessment Reports (RAR).
< data-path-to-node="14" dir="ltr">Key Responsibilities

 * Third-Party Risk Assessment: Perform third-party vendor risk assessments evaluating security evidence, conducting vendor interviews, and delivering actionable security feedback.
 * Deliverable Ownership: Create and maintain System & Data Inventories, Risk Registries, and formal Risk Assessment Reports (RAR).
 * Framework Compliance: Apply NIST SP 800-53, SP 800-30, SP 800-37, and the NC Statewide Information Security Manual to evaluate vendor compliance.
 * Stakeholder Reporting: Prioritize and summarize risk assessment findings and status updates for project managers and executive leadership.