Mid-Level Security Governance Analyst

Roles and Responsibilities

1. Awareness, Training, and Adoption

• Design visual and written cybersecurity learning content.
• Implement cybersecurity user awareness campaigns, learning programs, and communications to promote user adoption of new capabilities.
• Develop and deliver cybersecurity awareness materials and training to help protect the organization and its clients from cyberattacks, data breaches, reputational damage, and financial losses.

2. Compliance, Policies, Standards, and Processes

• Lead the preparation, execution, and completion of Information Security Management System (ISMS) certification activities.
• Develop, review, calibrate, and release Information Security Policies, Standards, Guidelines, and Procedures.
• Align company policies, standards, and processes with global cybersecurity frameworks.
• Conduct Information Security Compliance Audits across business and technology groups.
• Support regulatory compliance activities and the implementation of group-wide information security compliance programs.
• Perform periodic and project-specific User Access Reviews.
• Prepare compliance reports and support the monitoring of compliance metrics.

3. Third-Party Cybersecurity Risk Management

A. Third-Party Contract Management

• Build and maintain an inventory of third parties and assess their criticality to company operations.
• Review third-party contracts to ensure that the organization's cybersecurity requirements are appropriately incorporated.
• Review contract terms and conditions to support cyber risk management, including risks arising from subcontracting.
• Collect and analyze cybersecurity risk metrics and indicators to support ongoing monitoring.

B. Third-Party Cyber Risk Management

• Assess the security posture of third parties as part of engagement renewal or extension requirements.
• Monitor changes in third-party criticality and risk, and review third-party performance on an ongoing basis to manage cybersecurity risks.
• Monitor and assess sources of third-party cyber risk for potential systemic risks.
• Implement appropriate measures to manage third-party risks and improve information sharing.

4. Incident Response

• Support the execution of Incident Response Plan (IRP) exercises and simulations involving organizational entities, third parties, and relevant partners.

5. Compliance Management Support

• Respond to cybersecurity questionnaires related to insurance applications and other external assessment requirements to establish or benchmark the organization's security risk posture.
• Assist in preparing memorandums for internal stakeholders, including asset owners, process owners, and custodians, to ensure compliance with deadlines committed to auditors.

Qualifications and Requirements

• Bachelor's degree in a relevant field.
• Three to five years of relevant professional experience.
• Strong knowledge of security governance frameworks, particularly ISO 27001, NIST Cybersecurity Framework (NIST CSF), COBIT, and CIS Controls.
• Excellent communication skills, with the ability to create and deliver clear, engaging cybersecurity awareness content and training.
• Ability to analyze contracts and assess cybersecurity risk implications.
• Proficiency in developing, reviewing, and implementing information security policies, standards, and procedures.
• Strong analytical and problem-solving skills, particularly in compliance gap analysis and audit findings remediation.
• Ability to engage and collaborate effectively with stakeholders across business units, IT teams, and senior leadership.