Cyber Risk Analyst Job Boise Idaho USA,IT/Tech

Accountabilities

Cybersecurity audits and assessments:
Plan and conduct internal cybersecurity audits and control reviews across applications, infrastructure, and business processes. Document findings, evaluate potential impacts, and coordinate remediation activities with relevant teams through to closure.
Vendor and third-party risk management:
Perform security due diligence for vendors and external partners by reviewing security questionnaires, certifications, policies, and technical controls. Identify potential risks, recommend mitigation measures, and support the inclusion of appropriate security requirements in contracts when necessary.
Business continuity and disaster recovery:
Collaborate with stakeholders to maintain, validate, and improve business continuity and disaster recovery (BCP/DR) plans. Organize tabletop exercises and technical drills, document outcomes, and track corrective actions to completion.
Cyber governance and compliance:
Maintain and improve security policies, standards, procedures, and guidelines, ensuring alignment with NIST Cybersecurity Framework, ISO 27001, and applicable regulatory requirements.
Risk assessment and treatment:
Maintain the cybersecurity risk register and work with control owners and business stakeholders to identify, assess, and prioritize risks. Evaluate likelihood and impact, recommend appropriate treatment strategies, and monitor mitigation plans through resolution.
Management reporting:
Prepare reports and dashboards covering audit findings, risk exposure, vendor security assessments, business continuity exercise results, and progress toward ISMS and NIST CSF objectives.
Security awareness and training:
Develop and deliver employee awareness sessions and targeted training on topics such as phishing prevention, secure data handling, and role-specific security responsibilities.
Security communications:
Create clear, engaging awareness materials, including presentations, FAQs, and quick-reference guides, to encourage secure behaviors and strengthen the organization's security culture.
Continuous improvement:
Identify opportunities to improve security controls, governance processes, risk reporting, and cross-functional collaboration while supporting the effective implementation of cybersecurity standards and best practices.

Requirements

A bachelor's degree in an engineering discipline.
At least three years of professional experience in cybersecurity governance, risk, and compliance (GRC).
Practical experience implementing security controls and processes across business functions in alignment with frameworks such as NIST Cybersecurity Framework and ISO 27001.
Hands-on experience with a substantial portion of the responsibilities outlined for this role, ideally including security audits, third-party risk assessments, business continuity planning, and risk management.
Familiarity with relevant industry standards and regulatory requirements, such as SOC 2, ISO 27001, GDPR, and India's Digital Personal Data Protection (DPDP) framework.
The ability to conduct structured risk assessments, document findings, recommend mitigation strategies, and coordinate remediation activities with multiple stakeholders.
Strong analytical and problem-solving skills, with the ability to assess technical and operational risks and translate findings into actionable recommendations.
Excellent written and verbal communication skills, including the ability to explain cybersecurity concepts and compliance requirements to both technical and non-technical audiences.
Strong interpersonal and stakeholder management skills, with the ability to collaborate across departments and engage effectively with vendors and control owners.
A proactive, organized, and accountable working style, with the ability to manage multiple priorities and work independently in a remote environment.
Preferred certifications: CISA, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor.
Additional advantage:
Training or certifications in AI governance and AI risk management, such as ISO/IEC 42001, NIST AI Risk Management Framework (AI RMF), or recognized AI security and governance programs.

Benefits

Fully remote work:
Work remotely from India.
Permanent, full-time employment:
An opportunity to build a long-term career in cybersecurity governance, risk management, and compliance.
Professional growth:
Develop expertise in security audits, vendor risk management, business continuity, and recognized cybersecurity frameworks.
Learning and development:
Access…