IT Risk Analyst II

If you’re passionate about building a better future for individuals, communities, and our country—and you’re committed to working hard to play your part in building that future—consider WGU as the next step in your career.

Driven by a mission to expand access to higher education through online, competency-based degree programs, WGU is also committed to being a great place to work for a diverse workforce of student-focused professionals. The university has pioneered a new way to learn in the 21st century, one that has received praise from academic, industry, government, and media leaders. Whatever your role, working for WGU gives you a part to play in helping students graduate, creating a better tomorrow for themselves and their families.

The salary range for this position takes into account the wide range of factors that are considered in making compensation decisions including but not limited to skill sets; experience and training; licensure and certifications; and other business and organizational needs.

At WGU, it is not typical for an individual to be hired at or near the top of the range for their position, and compensation decisions are dependent on the facts and circumstances of each case. A reasonable estimate of the current range is:

Grade:
Technical 407

Pay Range: $ - $

The IT Risk Analyst II is a member of WGU's IT Security Risk team. Core responsibilities include third-party risk management (TPRM) and security risk assessments of vendors, suppliers, internal systems, and projects. The analyst recommends controls to reduce risk to the university, and those recommendations have to rest on real understanding: how the system works, what the vendor actually does for WGU, and what the business is trying to accomplish.

This is a seasoned analyst role. You will work independently on problems of diverse scope, exercise good judgment in selecting assessment methods, and advise stakeholders inside and outside the security function.

• Conduct third-party and supplier risk assessments end to end: scoping, evidence review (SOC 2 reports, questionnaires, contracts), risk analysis, and a clear residual risk conclusion.
• Conduct security risk assessments of internal systems, projects, and applications using industry-accepted frameworks, including NIST and similar standards.
• Perform Open-Source Intelligence (OSINT) research on third parties, suppliers, and applications to establish the security profile of the target of evaluation.
• Work with engineers, architects, and business units to understand how a system, vendor, or project actually works before recommending controls. Recommendations are grounded in that understanding, not in a checklist.
• Recommend security controls that fit the risk and the business context, and support the teams responsible for implementing them.
• Provide guidance to operational teams and third parties on remediating deficiencies identified in assessments. Remediation is owned by the responsible team; the analyst advises.
• Work with IT and business unit management to keep third parties, applications, and suppliers aligned with the university's security requirements.
• Serve as lead analyst on risk analysis, third-party risk, and exception-to-policy efforts as assigned.
• Articulate risk to management in plain language: what the risk is, who it affects, and what it costs to accept or fix.
• Measure, collect, and report on key risk indicators and information security services.
• Identify and build AI efficiencies in risk and assessment workflows, including AI-assisted analysis and agent-based tooling.
• Contribute to security policies, standards, procedures, and assessment methodologies; identify process gaps and drive improvement.
• Act as an advocate for information security, helping the business understand risk, standards, and best practices for third parties and products.

• Bachelor's degree in a related field and 3 years of relevant work experience, 7+ years of information security, or 6+ years of experience with a relevant certification.
• Working knowledge of risk management frameworks and practices, including NIST.
• Working…