App Risk Analyst

GRC - App Risk Analyst Other · Full Time · Hybrid

---

About the Role We are seeking a GRC App Risk Analyst to conduct technical application risk assessments, collaborate with agile Product teams, and implement mitigating technical controls. The role involves working with GIS and Business Units to develop and implement risk exception plans and strategies. The ideal candidate will have experience in information security and be able to work in an ever-changing cybersecurity environment.

---

Key Responsibilities

• Conduct technical application risk assessments to identify cyber vulnerabilities and operational and regulatory threats.
• Collaborate with agile Product teams and GIS to implement mitigating technical controls aligned with GIS policies and regulatory standards.
• Prepare detailed assessment reports for Business Unit owners, highlighting key risks and policy exceptions through threat modeling.
• Partner with GIS and Business Units to develop and implement risk exception plans and strategies.
• Support the development of automated quantitative and qualitative risk analyses and reporting processes.
• Liaise with internal and external auditors to provide documentation and evidence for compliance with international security standards (SOC-2, ISO 27001, PCI DSS, NIST CSF 2.0).
• Provide mentorship on changes in product security and regulatory landscapes, updating Security Policies, Standards, and Technical Security Requirements as needed.
• Support the delivery of the wider GIS Security program in line with the company's strategy and important metrics.

---

Requirements

• Have 10+ years of experience in information security with a relevant degree.
• Possess excellent collaboration skills, eager to work as part of a cohesive, distributed team.
• Have outstanding analytical and critical thinking skills.
• Have comprehensive communication skills, including effective listening, data gathering, and idea articulation.
• Have IT Audit, Internal Audit, and/or cyber advisory experience.
• Be familiar with cybersecurity industry standards and frameworks such as NIST CSF, NIST 800-53, ISO 27001, and PCI DSS.

---

Good to Have

• Have preferred certifications: CISSP, CCSP, CISM, CISA, CompTIA Security+, GIAC.

---

What We Offer

• Opportunity to work in a hybrid mode, with 3 days office per week, minimum 7 hours per day.
• Full Time for a minimum of 6 months with an on-roll option based on performance.