Information Security Risk & Compliance Analyst

 The Information Security Risk & Compliance Analyst is responsible for the day-to-day tactical support of WPCU’s Information Security Risk program and Third-Party Risk Management (TPRM) program. The position performs risk assessments for products and technologies following industry recognized frameworks such as CIS, NIST, MITRE ATT&CK and OWASP Top 10. This role is required to work closely with business units, Information Technology, and Enterprise Risk Management. They serve as the Information Security Subject Matter Expert (SME) for vendor risk management and will conduct evaluations of new and existing third-party relationships including but not limited to: conducting document due diligence; supporting contract reviews; and identifying risks associated with vendors. They are responsible for ensuring all risks identified either through Information Security Risk Assessments or TPRM program are properly documented in the Issue Management, seeking regular updates towards resolution, and escalating concerns when needed. 

1)      Third Party Risk Management (TPRM) program (40%)

a)       Evaluate technology and cybersecurity risks presented by new and existing vendors, disaster recovery, or business continuity.

b)      Collaborate with Vendor Risk Management under Enterprise Risk to determine required risk tiers and execute workflows to capture corresponding due diligence requirements.

c)       Review and assess due diligence documents for adequacy, control effectiveness, and gaps.

d)      Coordinate with business units to understand business impacts of risks identified during the vendor due diligence process.

e)      Collaborate with Legal to ensure contract terms are commensurate with vendor due diligence requirements such as identifying Service Level Agreements (SLA), Data Residency requirements, and Data Breach.

f)        Document findings, residual risks, and recommendations within the TRPM tools and Issue Management platform.

g)       Provide thought leadership on maturing the Information Security components of TPRM.

2)      Risk Assessment Methodology (40%)

a)       Development of new risk assessments that address emerging technologies such as Artificial Intelligence (AI).  Risk Assessment methodology must be based on industry standards such as MITRE and NIST CSF.

b)      Execution of existing risk assessments on their assigned basis to determine drift or changes from previous assessments.  This may include identification of new risks, updating existing risks, or identifying new / changed / removed controls.

c)       Develop and maintain a consistent process for identifying the inherent likelihood, inherent impact, and control effectiveness. Process must be applicable to individual assets, groups of assets, or process.

d)      Collaborate with the Information Security team to identify where changes in control effectiveness impact existing risks.

e)      Collaborate with Information Security Analysts to build and maintain a control library that properly documents all active/available controls.

f)        Ensures proper policies, procedures, risk mitigation activities, and operating controls are followed.  Reports gaps in policies, procedures, and operating controls to leadership to ensure member impact and risk is mitigated.  

3)      Issue Management (20%)

a)       Ensure risks exceeding enterprise risk appetite are properly entered into the Issue Management system in a timely fashion.

b)      Complete timely and recurring reviews of risk mitigation or remediation plans identified during the risk assessment.

c)       Ensure risks identified during projects or Control Effectiveness Reviews are properly tracked in Issue Management.

d)      Provide thought leadership on monitoring / reporting of Issue Management.

Required Skills

1)      Bachelor’s Degree in information technology, information security, or risk management is required. Candidates without a bachelor’s degree will be considered who can demonstrate equivalent work experience or training.

2)      One of the following certifications is required: CISSP, CRISC, CTPRP, CRVPM or similar information security or vendor management certification.  Candidates without this certification will be considered, however they will be required to obtain certification within the first year of employment.

3)      3+ years of experience in information technology or information security field required. Must include at least 2 years of experience in third-party risk management, vendor risk management, and information security or cybersecurity risk management.

4)      Must have familiarity with MITRE framework,  PCI-DSS, and NIST RMF.

5)      Must demonstrate the ability to interpret SOC reports and cybersecurity controls.

Valid driver’s license is required as the position will be required to travel to various locations to complete assessments.