The Cybersecurity Risk Analyst is responsible for building relationships across the firm with technical leads and business partners, and understanding technology stacks, designs, and review processes in support of the cyber risk management practices. The role will participate in the development, implementation, and execution of a measurements-based cyber risk management program.

Essential Position Accountabilities: 

1. Reviews and assesses new and existing vendor engagements. Collaborates with technical leads and business partners to ensure comprehensive vendor portfolio management.  
2. Helps plan and implement process improvements to the cybersecurity risk management program. 
3. Develops and maintains documentation and metrics. Compiles program metrics required to assess the third-party cybersecurity risk management program and the Bank’s cyber risk posture to support risk reduction and produce executive reports with pertinent trending/forecasting metrics. 
4. Assists management in configuring, enhancing, and maintaining cybersecurity risk management tools and systems. 
5. Assists management with developing and implementing processes to support cyber risk identification, assessment, and impact analysis capabilities for the Bank. Conducts loss simulations and collaborates with technical leads and business partners on risk mitigation strategies.
6. Assists management with the development and maintenance of a registry of cyber risks and associated loss events through cyber scenario planning with business units. 

The ideal candidate will have:

• Bachelor’s degree in computer science, management information systems (MIS), engineering, statistics or related field, or equivalent work experience required
• Certified Information Systems Security Professional (CISSP), ISACA Certified in Risk and Information Systems Control (CRISC), or comparable security certification desired
• Working knowledge of requirements for Federal Financial Institutions Examination Council (FFIEC) IT examination, Gramm-Leach-Bliley Act (GLBA) Information Security Standards and Sarbanes-Oxley Section 404 (“Management Assessment of Internal Controls”)
• One or more years of experience in information security required (level I)
• Two or more years of experience in information security required (level II) 
• Cyber risk management experience
• Experience designing, implementing and managing risk management processes and workflows
• Develop and implement security plans and projects
• Knowledgeable in risk quantification modeling and platforms (e.g., strong understanding of basic probability, calibrated estimations, monte carlo simulations, etc.)
• Performs cybersecurity risk assessments and ongoing monitoring. (level II)
• Coordinates with managers and staff of IT, business units, and executive management. (level II)
• Able to plan, organize and budget
• Good written and verbal communication with demonstrable experience collaborating with technically oriented as well as business audiences
• Strong critical thinking and analytical skills
• Able to handle confidential matters judiciously
• Possesses attention to detail with excellent follow-through
• Able to work under pressure with multiple deadlines
• Good time management skills

This is a hybrid role. This role is to be filled outside the states of California and Colorado.

**We are an equal opportunity employer and value diversity at our company. We do not discriminate based on race, religion, color, ethnic origin, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.**

#LI-JC2