Information Security Risk Analyst

Position Title: Information Security Risk Analyst

Location: Raleigh, NC

Work Arrangement: Remote

Interview Process: Webcam Interview Only

Seeking a Mid-Level Information Security Risk Analyst to lead annual Third-Party Risk Assessments (TPA) for technical implementation vendors based on state security standards. Operating alongside a lead analyst, this position owns the delivery of system and data inventories, risk registries, and Risk Assessment Reports (RAR).

• Third-Party Risk Assessment: Perform third-party vendor risk assessments evaluating security evidence, conducting vendor interviews, and delivering actionable security feedback.

• Deliverable Ownership: Create and maintain System & Data Inventories, Risk Registries, and formal Risk Assessment Reports (RAR).

• Framework Compliance: Apply NIST SP 800-53, SP 800-30, SP 800-37, and the NC Statewide Information Security Manual to evaluate vendor compliance.

• Stakeholder Reporting: Prioritize and summarize risk assessment findings and status updates for project managers and executive leadership.

• NIST & Compliance Frameworks: 3+ years of hands-on experience applying NIST SP 800-53, SP 800-30, and SP 800-37 guidelines.

• Vendor Risk Auditing: 3+ years of experience conducting vendor interviews, evaluating technical evidence, and generating risk registry reports.

• Security Technologies: 5+ years of experience with mainstream operating systems, identity and access management (IAM), network security appliances, and cryptography.

• Education: Bachelor's degree with 2+ years of IT security experience, Associate degree with 3+ years, or equivalent experience.

• Industry professional certifications (CISSP, CISM, or equivalent).

• Experience evaluating against NIST Cybersecurity Framework (CSF) or HITRUST standards.