Cyber Risk Management Analyst; GRC)

Cyber Risk Management Analyst (GRC)

Location: Remote Philippines

Duration: 12+ month contract

Compensation: Competitive, based on experience

Work Requirements: Citizen of the country of employment or authorized to work in that country.

• Execute software assessments and vulnerability management activities using a structured, repeatable approach.
• Capture evidence, document findings, track remediation items, and record stakeholder comments.
• Produce complete assessment packages, status updates, and reporting outputs for manager review and final risk decisions.

• Conduct risk assessments to identify potential threats and vulnerabilities across business applications and services.
• Support the development and maintenance of cyber risk scenarios and scenario-based risk statements with required comments and evidence.
• Coordinate working sessions with system owners, track follow-ups, and close documentation gaps.

• Perform software assessments for applications, platforms, and technology services to identify control gaps, security concerns, and required follow-up actions.
• Support vulnerability management processes by validating findings, tracking remediation progress, and ensuring assessment outputs are documented for downstream review and leadership visibility.

• Monitor and report Cyber Key Risk Indicators (KRIs) under guidance from senior team members.
• Provide inputs for leadership cadence and steering reporting.
• Stay informed on emerging threats and assist with updates to risk mitigation strategies and assessment content based on new risk signals and program direction.
• Document assessments initially in Excel spreadsheets and support migration to automation in the new GRC platform.
• Upload supporting artifacts to the team repository for audit readiness.
• Produce exports and status summaries for leadership cadence and steering meetings.
• Update manager weekly on progress, including closed assessments, open assessments, and roadblocks requiring escalation.

• Offshore/Nearshore resource drafts assessments, maintains trackers, and packages evidence.
• Onshore leadership owns final risk ratings, approvals, and risk acceptance decisions.

• 3+ years executing software assessments and vulnerability management activities with strong documentation, evidence collection, and stakeholder follow-up discipline.
• Demonstrated ability to develop and maintain scenario-based cyber risk statements and capture consistent scoring inputs with clear rationale in a repeatable format.
• Experience performing software assessments and supporting vulnerability management processes, including documenting findings, tracking remediation items, and producing assessment packages for review.
• Experience identifying security gaps in applications, platforms, or systems and documenting key risks, mitigation actions, and remediation progress for leadership review.
• Experience analyzing legacy systems for security gaps and supporting remediation tracking to reduce technical debt.
• Strong Excel skills for assessment tracking and rollups, plus clear written status reporting for leadership cadence.
• Strong technical skills with standard business tools and systems, including Outlook, Teams, Zoom, video calls, meeting coordination, scheduling management, SharePoint, Excel, PowerPoint, and Power BI.
• Familiarity with software assessment practices, including use of structured questionnaires, evidence capture, and production of assessment report packages.
• Experience supporting software assessment and vulnerability management workflows, including coordinating required inputs for downstream review, remediation tracking, and approvals.
• Experience assessing applications, platforms, or systems for security gaps and documenting data handling, control concerns, and recommended mitigation actions for leadership review.
• Experience supporting risk scenario development and scenario-based risk statements for stakeholder-friendly assessments and reporting.
• Exposure to enterprise cyber risk assessment methods that incorporate stakeholder input and structured scoring approaches for likelihood, impact, and preparedness.
• Experience monitoring and reporting cyber program metrics and providing inputs for recurring leadership and steering cadences.
• Experience supporting technical debt risk reduction efforts, including analysis and remediation tracking for…