Cyber Risk Analyst

Accountabilities • Cybersecurity audits and assessments: Plan and conduct internal cybersecurity audits and control reviews across applications, infrastructure, and business processes. Document findings, evaluate potential impacts, and coordinate remediation activities with relevant teams through to closure.

• Vendor and third-party risk management: Perform security due diligence for vendors and external partners by reviewing security questionnaires, certifications, policies, and technical controls. Identify potential risks, recommend mitigation measures, and support the inclusion of appropriate security requirements in contracts when necessary.

• Business continuity and disaster recovery: Collaborate with stakeholders to maintain, validate, and improve business continuity and disaster recovery (BCP/DR) plans. Organize tabletop exercises and technical drills, document outcomes, and track corrective actions to completion.

• Cyber governance and compliance: Maintain and improve security policies, standards, procedures, and guidelines, ensuring alignment with NIST Cybersecurity Framework, ISO 27001, and applicable regulatory requirements.

• Risk assessment and treatment: Maintain the cybersecurity risk register and work with control owners and business stakeholders to identify, assess, and prioritize risks. Evaluate likelihood and impact, recommend appropriate treatment strategies, and monitor mitigation plans through resolution.

• Management reporting: Prepare reports and dashboards covering audit findings, risk exposure, vendor security assessments, business continuity exercise results, and progress toward ISMS and NIST CSF objectives.

• Security awareness and training: Develop and deliver employee awareness sessions and targeted training on topics such as phishing prevention, secure data handling, and role-specific security responsibilities.

• Security communications: Create clear, engaging awareness materials, including presentations, FAQs, and quick-reference guides, to encourage secure behaviors and strengthen the organization's security culture.

• Continuous improvement: Identify opportunities to improve security controls, governance processes, risk reporting, and cross-functional collaboration while supporting the effective implementation of cybersecurity standards and best practices.

Requirements

• A bachelor's degree in an engineering discipline.

• At least three years of professional experience in cybersecurity governance, risk, and compliance (GRC).

• Practical experience implementing security controls and processes across business functions in alignment with frameworks such as NIST Cybersecurity Framework and ISO 27001.

• Hands-on experience with a substantial portion of the responsibilities outlined for this role, ideally including security audits, third-party risk assessments, business continuity planning, and risk management.

• Familiarity with relevant industry standards and regulatory requirements, such as SOC 2, ISO 27001, GDPR, and India's Digital Personal Data Protection (DPDP) framework.

• The ability to conduct structured risk assessments, document findings, recommend mitigation strategies, and coordinate remediation activities with multiple stakeholders.

• Strong analytical and problem-solving skills, with the ability to assess technical and operational risks and translate findings into actionable recommendations.

• Excellent written and verbal communication skills, including the ability to explain cybersecurity concepts and compliance requirements to both technical and non-technical audiences.

• Strong interpersonal and stakeholder management skills, with the ability to collaborate across departments and engage effectively with vendors and control owners.

• A proactive, organized, and accountable working style, with the ability to manage multiple priorities and work independently in a remote environment.

• Preferred certifications: CISA, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor.

• Additional advantage: Training or certifications in AI governance and AI risk management, such as ISO/IEC 42001, NIST AI Risk Management Framework (AI RMF), or recognized AI security and governance programs.

Benefits

• Fully remote work: Work remotely from India.

• Permanent, full-time employment: An opportunity to build a long-term career in cybersecurity governance, risk management, and compliance.

• Professional growth: Develop expertise in security audits, vendor risk management, business continuity, and recognized cybersecurity frameworks.

• Learning and development: Access to structured development opportunities designed to strengthen professional, leadership, and management capabilities.

• Collaborative culture: Work with colleagues across technical and business functions in an open-minded, innovation-focused environment.

• International exposure: Collaborate with professionals from different countries, cultures, and backgrounds.

• Purpose-driven work: Contribute to an organization focused on expanding access to affordable, reliable energy and delivering positive social and environmental impact.

How Jobgether works: We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team. We appreciate your interest and wish you the best! Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1