IT Risk Analyst

We are hiring an IT Risk Analyst I to join a growing IT Risk Management team. This is a hands-on contributor role focused on strengthening IT risk practices across policy management, controls, third-party risk, and operational resilience. This is not an internal auditor position. You will collaborate closely with IT, cybersecurity, compliance, and business stakeholders to keep risk management processes moving, maintain high-quality documentation, and support audit and regulatory exam readiness., * Own and manage the full lifecycle of IT policy and standards management, including scheduled reviews, stakeholder follow-ups, documentation updates, and process improvements.

• Develop and maintain IT risk documentation, including policies, plans, procedures, and the IT risk register.
• Support responses to internal and external IT audits and state examinations by gathering evidence, coordinating with control owners, and producing clear, accurate documentation.
• Support IT risk assessments, including identifying risks, documenting impacts, and tracking remediation activities to completion.
• Monitor key risk indicators (KRIs) and assist with reporting for IT risk governance, compliance reviews, and regulatory needs.
• Support IT general controls and control testing activities, including defining evidence expectations and validating documentation.
• Oversee business continuity and disaster recovery documentation, support disaster recovery testing (DRT), and help ensure continuity readiness.
• Partner with cybersecurity teams to assess security controls and support incident response planning and documentation.
• Perform vendor risk assessments internally by reviewing questionnaires and supporting documentation (for example SOC reports), including AI vendor risk assessments when applicable.
• Embed AI considerations into evolving processes, documentation, and risk assessment workflows as the organization adopts new capabilities.
• Drive adoption of established IT risk management standards and frameworks such as NIST, ISO 27001 family, COBIT, and FAIR (as applicable).
• Educate and coach internal teams on audit readiness, control expectations, and practical risk management practices., * This is a hybrid role. Expect additional onsite time during onboarding, then transition to a hybrid schedule with 2 to 3 remote days per week.
• Employees must maintain a dedicated, distraction-free workspace when working remotely.
• Reliable high-speed internet and a company-approved technology setup are required for remote work.
• Cameras are expected to be on for virtual meetings.
• Standard office environment expectations apply, including regular sitting, use of hands for computer work, and communicating in meetings.
• Employees working offsite must follow proper measures and precautions to protect company data, proprietary information, and assets.

• Bachelor’s degree from an accredited college or university.
• 2 to 5 years of experience in IT risk management, information security, compliance, governance/risk/controls, or a closely related area.
• A foundational background in IT that enables you to understand technical requirements and work effectively with technical teams (systems, infrastructure, networking concepts, security configurations).
• Strong business analyst capabilities, including requirements gathering, process documentation, stakeholder follow-up, and translating technical topics into clear written materials.
• Working knowledge of risk management frameworks and control concepts (for example NIST, ISO 27001, COBIT, FAIR), IT general controls, and control testing approaches.
• Strong written and verbal communication skills, with the ability to produce audit-ready narratives and documentation.
• Strong organizational skills, sound judgment, and an ownership mindset with consistent follow-through., * Certifications such as CRISC, CISA, COBIT, CIA, CFSA, or similar.
• Experience reviewing vendor risk documentation such as SOC reports and security questionnaires.
• Experience supporting business continuity, disaster recovery, and incident response documentation and testing.
• Industry experience is helpful but not required.