Cybersecurity Analyst V - Remote

Job Title:

Cybersecurity Analyst V - Remote

Requisition Number: R8025

Location:

Arizona - Home Teleworkers (Additional Locations available)

CSAA Insurance Group (CSAA IG), a AAA insurer, is one of the leading personal lines property and casualty insurance groups in the United States. Here, every employee shapes our mission. We build innovative, human-centered solutions that help AAA members prevent, prepare for, and recover from life's uncertainties. You will join a collaborative, inclusive culture where your strengths have room to grow and your ideas can drive real impact.

Step into a role where you can contribute to our shared success through meaningful work. We are actively hiring for a Cybersecurity Analyst V - Remote.

• Lead cross-domain cybersecurity and technology risk assessments for complex initiatives, critical business processes, control environments, and emerging technologies, including cloud and artificial intelligence use cases.
• Define and improve risk assessment approaches, methodologies, standards, and supporting tools to promote consistent identification, analysis, documentation, and treatment of risk.
• Apply qualitative and quantitative analysis, including probability, impact, and scenario-based methods, to clarify exposure, compare response options, and support risk-informed decisions.
• Evaluate the design and effectiveness of cybersecurity controls and technologies, identify material gaps or systemic themes, and recommend proportionate mitigation, acceptance, transfer, or avoidance strategies.
• Serve as a strategic advisor to technology, cybersecurity, and business partners on risk, governance, control, and operational implications.
• Translate complex technical risk into concise business impact, options, trade-offs, and recommendations for leaders and non-technical audiences through briefings, presentations, whitepapers, and position papers.
• Lead workshops and team member discussions that establish shared understanding, resolve ambiguity, and drive alignment on risk ownership, treatment decisions, priority, and resource needs.
• Integrate risk considerations into the lifecycle of technology projects, capabilities, and business initiatives, translating technical risk into business impact and supporting informed decision-making aligned with organizational objectives.
• Lead risk framework, reporting, tooling, capability-building, and maturity improvement efforts that span cybersecurity domains and functions.
• Identify trends and interdependencies across risks, controls, technologies, and business operations; communicate implications and recommend program-level improvements.
• Mentor analysts and risk professionals, share advanced analytical practices, and strengthen consistent application of cybersecurity risk management methods.
• Maintain awareness of emerging threats, evolving technologies, regulatory requirements, and industry trends, using these insights to strengthen and enhance cybersecurity risk advisory capabilities.

• 8-10 years of progressive experience in cybersecurity, technology risk management, IT operations, IT audit, governance, compliance, or related technical fields.
• Demonstrated experience leading complex analyses or cross-functional initiatives, advising stakeholders on risk and control implications, and delivering major work products with a high degree of autonomy.
• Experience applying cybersecurity risk management methodologies, control frameworks, governance models, and supporting tools in an enterprise environment.
• Bachelor's degree in Cybersecurity, Information Systems, Computer Science, Information Technology, or a related field; or equivalent practical experience may be considered in place of a bachelor's degree.

• Recognized domain expertise in cybersecurity risk management, governance, control assessment, risk response, and capability or maturity models.
• Thorough knowledge of cybersecurity standards and frameworks such as NIST, ISO 27001, and CIS Controls, with the ability to advise on practical application.
• Broad understanding of cybersecurity domains and the technologies they protect, including cloud services, networks and infrastructure, applications, data, identity, databases, protocols, security tools, and emerging technologies.
• Understands how security capabilities and controls reduce cybersecurity risk.
• Exceptional problem analysis in complex, ambiguous, or novel scenarios.
• Identifies systemic issues and broader…