CISS Risk Analyst

Job Description

Assess the controls at our suppliers to ensure they are adequate to mitigate the risk of outsourcing to that supplier.

• Interpret independent reviews of the supplier, conduct minimal on‑site reviews and testing at the supplier, and use tools such as MS Office, Archer, and Hiperos to automate and communicate the scoring of inherent and residual risks involved in supplier relationships.

• Information security experience, preferably third‑party risk management and compliance.
• Familiarity with SOC 1 (SSAE 16) and SOC 2 (AT 101) reports.
• Ability to write processes, procedures, and flowcharts.
• Knowledge of regulatory and industry standards such as GLBA, HIPAA, COBIT, and FFIEC.

• Knowledge of FS‑ISAC Shared Assessments, penetration test results, and PCI DSS.
• Experience performing on‑site third‑party reviews.
• CISA, CISSP, CRISC, or other security certifications.
• Archer (eGRC) or Hiperos (Supplier Management) experience.
• Knowledge of Visual Basic and macro coding for MS Office applications.