Analyst - Business Risk Controls Management

Conduct application risk assessments aligned with defined security frameworks (e.g., NIST CSF, ISO 27001) to identify and rate risks in enterprise applications.

Validate and track security controls, document findings, and follow remediation efforts with application owners.

Maintain accurate risk records in GRC tools and contribute to process improvements and assessment methodologies.

3+ years of work experience required; 5+ years preferred.

1+ year experience in cybersecurity, risk, or application support.

Basic understanding of web applications, APIs, OWASP Top 10 vulnerabilities, and authentication/access control concepts.

Vocational and/or Technical education preferred; Work Experience Required: 3+ years explicitly mentioned.

Comfortable working at the intersection of technology and risk with ownership of application risk assessment tasks and clear communication of risks in business terms.

Demonstrated experience applying structured risk methodologies and frameworks in an operational environment.

Experience with GRC tools, security controls validation, and familiarity with cloud basics and secure SDLC practices preferred but not mandatory.