Information Security Risk & Vulnerability Management Analyst

The Information Security Risk & Vulnerability Management Analyst is an individual contributor responsible for executing cybersecurity risk management, vulnerability management, and control assurance activities across the JFG enterprise. This role supports the identification, assessment, prioritization, and remediation of technology risks and vulnerabilities in alignment with JFG’s risk tolerance, regulatory expectations, and internal control standards. The analyst performs risk analysis, control validation, vulnerability lifecycle management, and remediation coordination to help reduce overall cyber risk exposure.

Working under the direction of the Information Security Risk & Resiliency Manager, this position operationalizes cyber risk governance processes, including issues and exceptions management, audit support, control effectiveness validation testing, and risk reporting. The analyst operates across multiple security domains, with a primary focus on cyber risk management and vulnerability management, while supporting resilience and post-incident improvement activities. In collaboration with IT, Enterprise Risk Management, Internal Audit, and business stakeholders, this role translates technical findings into business-aligned risk insights and drives remediation outcomes.

This position requires strong analytical capability, cross-functional collaboration, and the ability to communicate risk in both technical and business terms. The role is supported by third-party services and enterprise tools, with occasional off-hours support required. Minimal travel less than 5% is expected.

• Perform cyber risk assessments, control testing, and risk analysis across infrastructure, applications, and business processes
• Execute and maintain cyber risk issues and exceptions lifecycle, including identification, documentation, tracking, and remediation validation
• Support risk exception and risk acceptance workflows, including preparation of analysis, documentation, and impact summaries
• Assist in audit coordination, regulatory support, and control compliance activities, including evidence collection and documentation
• Translate technical findings into business-aligned risk insights for reporting and decision-making
• Contribute to third‑party / supply chain risk assessments, including risk scoring and remediation tracking
• Execute enterprise vulnerability scanning, analysis, and reporting across infrastructure, cloud, and applications
• Identify and assess configuration weaknesses, security gaps, and exposure risks
• Perform risk‑based prioritization using severity, exploitability, business impact, and other factors as appropriate
• Coordinate with IT and application teams to drive remediation and validate closure evidence
• Maintain system‑of‑record accuracy for vulnerability tracking and reporting
• Support application security testing (SCA/SAST/DAST) coordination and findings management
• Execute technical control testing and validation activities under defined standards
• Collect and maintain audit evidence to support control assurance and audit readiness
• Produce operational metrics, dashboards, and reporting to support management decision‑making
• Assist in mapping controls to frameworks and regulatory requirements (e.g., CIS Controls)
• Identify and document control gaps, inconsistencies, and process improvement opportunities
• Support post‑incident remediation tracking and integration into risk and issues management processes
• Assist in gathering inputs for business impact analysis (BIA) and resiliency assessments
• Document and track corrective actions, lessons learned, and control improvements from incidents, exercises, and reviews
• Partner with IT, ERM, Audit, Vendor Management, and business teams to integrate…