Senior Cybersecurity Risk Management Analyst

Help us change lives

At Exact Sciences, we’re helping change how the world prevents, detects and guides treatment for cancer. We give patients and clinicians the clarity needed to make confident decisions when they matter most. Join our team to find a purpose-driven career, an inclusive culture, and robust benefits to support your life while you’re working to help others.

At Exact Sciences, we are cancer fighters. We are united by our mission to change lives by providing earlier, smarter answers. Through advances in cancer detection and treatment guidance, we will help eradicate the disease and the suffering it causes. Exact Sciences’ Cybersecurity organization supports this mission by defending the millions of digital patient, practitioner, and employee lives within our environments.

Defending today and securing tomorrow is no small feat. To help achieve this, the team is in search of a cybersecurity risk management subject matter expert to join our collaborative team comprised of passionate experts.

The Senior Cybersecurity Risk Management Analyst, reporting to the Director of Cybersecurity Strategy & GRC, is responsible for supporting and advancing the organization’s cybersecurity risk management program. This role requires a deep understanding of security and IT risk principles, processes, and practices, combined with the ability to integrate security into business operations. The position demands both technical expertise and strong cultural awareness to effectively identify, assess, monitor, and report cybersecurity risks across the enterprise.

Include, but are not limited to, the following:

• Support cybersecurity risk management activities by assisting with defined stages of the risk management lifecycle and completing assigned analyses under established methodologies.
• Maintain and contribute to the global cybersecurity risk register.
• Assist management by providing input to cybersecurity risk appetite discussions and support implementation and enforcement efforts—making it relevant to the business on a day-to-day basis.
• Aggregate and evaluate cybersecurity risks to support management and leadership reporting, ensuring accuracy and consistency for various global audiences.
• Build trust and effectively facilitate risk identification/analysis/treatment discussions.
• Proactively obtain information on emerging risks and threats and effectively analyze against the risk posture.
• Support the delivery of risk management education by preparing materials, reinforcing frameworks, and responding to stakeholder questions.
• Work with leadership to support the prioritization of initiatives aligned with strategic goals.
• Act as a resource providing training, guidance, and mentoring to less experienced staff.
• Collaborate with stakeholders to remediate visibility and capability gaps and breakdown roadblocks standing in the way of a robust security posture.
• Enable the maturation of the security program functions within the cybersecurity team and with key business partners.
• Research and summarize industry insights and best practices, along with interpreting impact of requirements from governing authorities.
• Uphold company mission and values through accountability, innovation, integrity, quality, and teamwork.
• Support and comply with the company’s Quality Management System policies and procedures.
• Maintain regular and reliable attendance.
• Ability to act with an inclusion mindset and model these behaviors for the organization.
• Ability to travel 10% of working time away from work location, may include overnight/weekend travel.

• Bachelor’s Degree in field related to essential duties; or Associate Degree and 2 years of relevant experience; or High School Diploma or General Education Degree (GED) and 4 years of relevant experience.
• 6+ years of professional experience in a cybersecurity or IT governance, risk, compliance, or operations role.
• 1+ years of experience with cybersecurity risk management.
• Demonstrated experience with security risk management and compliance frameworks (e.g., NIST, ISO, HIPAA).
• Experience evaluating risk rating methodologies to appropriately convey the…