Cyber Risk Analyst

Plan and execute internal cyber security audits and control reviews across applications, infrastructure, and business processes.

Document findings, assess risk and impact, and track remediation through closure with respective teams.

Conduct security due diligence for vendors and third parties: review security questionnaires, certifications, and technical controls to ensure they meet organizational requirements.

Identify and track vendor risks, recommend mitigation measures, and support contractual security requirements where needed.

Work with stakeholders to maintain and test business continuity and disaster recovery (BCP/DR) plans.

Plan, coordinate, and document tabletop exercises and technical BCP/DR drills, track and follow up on corrective actions.

Maintain up‑to‑date security policies, standards, procedures, and guidelines, ensuring alignment with NIST CSF, ISO 27001, and relevant regulations.

Prepare regular reports and dashboards on audit findings, risk status, BCP drill outcomes, vendor risk posture, and ISMS/NIST CSF progress for management.

Maintain and update the cyber risk register, working with control owners and business stakeholders to identify, assess, and prioritize risks.

Perform risk assessments (likelihood/impact), propose risk treatment options (mitigate, accept, transfer, avoid), and track treatment plans to closure.

Develop and deliver cyber security awareness sessions and targeted training for employees, including phishing awareness, secure handling of data, and role‑based security topics.

Create clear, engaging communication materials (presentations, FAQs, quick guides) to improve security culture.

Bachelor's degree in any engineering discipline.