Senior Security Risk Analyst

Position Purpose: This role serves as the authoritative owner of the cybersecurity risk lifecycle management process within Enterprise Privacy & Security Risk Management (EPSRM), accountable for the integrity, structure, lifecycle management, and effectiveness of how cybersecurity risks are identified, documented, governed, monitored, and communicated across the enterprise. The position ensures cybersecurity risks are consistently captured, normalized, and managed in alignment with enterprise risk management (ERM) expectations and Centene’s risk appetite.

The role coordinates risk intake from multiple cybersecurity governance, risk, and compliance (GRC) workstreams—including assessments, control monitoring, testing, and issues management—by establishing standardized taxonomy, workflows, and documentation requirements. It ensures risks are traceable to underlying assets, threats, vulnerabilities, controls, and remediation activities, enabling a defensible and auditable view of cybersecurity risk exposure.

This role partners closely with cybersecurity risk owners, Enterprise Risk Management, technology and business stakeholders, and EPSRM leadership to maintain a clear, current, and decision ready view of Centene’s cybersecurity risk posture. It translates complex risk data into actionable insights through dashboards, recurring reporting, and trend analysis that support prioritization, accountability, and executive level decision making.

In addition to core risk register responsibilities, this role contributes to specialty projects within the GRC domain as assigned. These projects may include targeted risk or control initiatives, framework alignment efforts, tooling or process enhancements, regulatory or audit support activities, metrics modernization, or maturity improvement efforts that advance EPSRM program objectives. Through both steady state operations and project based work, the role supports disciplined, risk informed decision making and a culture of transparency and customer centric communication consistent with EPSRM’s mission.

Key Details: Must be authorized to work in the U.S. without the need for employment-based visa sponsorship now or in the future. Sponsorship and future sponsorship are not available for this opportunity, including employment-based visa types H-1B, L-1, O-1, H-1B1, F-1, J -1, OPT, or CPT.

• Own and manage the lifecycle and documentation of cybersecurity risks, coordinating all activities related to risk intake, documentation, validation, monitoring, escalation, and reporting. Develop, define, and maintain standardized processes for capturing risks from multiple cybersecurity GRC workstreams, including risk assessments, penetration testing, control monitoring, maturity assessments, and security issue management.
• Design and maintain the cybersecurity risk register structure to support effective cybersecurity risk management, including risk taxonomy, categorization, scoring attributes, lifecycle states, ownership models, escalation thresholds, workflows, and roles and responsibilities. Ensure consistency, traceability, and auditability across all captured risks.
• Own and maintain the cybersecurity component of the enterprise risk register, ensuring risks are properly entered, clearly documented, consistently managed, and kept current. Partner and coordinate with Enterprise Risk Management to ensure cybersecurity risk management requirements are met by the enterprise risk management program, and that the cybersecurity risk management program aligns with the enterprise risk management program.
• Engage directly with cybersecurity risk owners and their delegates to understand the nature, root causes, drivers, and potential impacts of identified risks, as well as associated mitigation strategies, remediation plans, projects, and control activities. Coordinate across technology, security, compliance, and business teams as necessary to ensure complete and accurate risk representation, and to advise all stakeholders of the requirements and processes for involvement with the risk register.
• Serve as a subject matter resource for risk register usage, governance requirements, and lifecycle processes. Advise stakeholders on risk documentation standards, ownership responsibilities, status updates, and escalation protocols to ensure consistent participation and accountability.
• Provide regular reporting to Cybersecurity GRC leadership, EPSRM leadership, and risk owners on individual risks (including trends, aging, and progress) and the overall cybersecurity risk profile. Highlight top, emerging, and persistent cybersecurity risks to support prioritization, resource allocation, and executive decision making.
• Work closely with teams responsible for penetration testing, risk assessments, control monitoring, and cybersecurity maturity assessments to ensure upstream findings are appropriately evaluated, translated into risks when necessary, and accurately reflected as documented risks. Coordinate with the security issues management function to maintain clear linkage and visibility between findings, issues, remediation actions, and documented risks.
• Develop, maintain, and continuously improve dashboards, scorecards, and recurring reporting artifacts that communicate cybersecurity risk posture, trends, and management activity to a broad range of stakeholders. Partner with metrics, reporting, data, and analytics teams to improve data quality, automation, consistency, and scalability of risk reporting.
• Participate in and support specialty GRC projects as assigned, which may include risk taxonomy refinement, framework or regulatory mapping (e.g., NIST CSF, ISO 27001, HITRUST CSF), GRC tooling enhancements, audit or examination support, control or issue lifecycle improvements, metrics governance initiatives, or targeted risk deep dives. Contribute subject matter expertise, documentation, analysis, and coordination support to ensure successful project outcomes.
• Develop and maintain cybersecurity risk management program documentation, including charters, policies, standards, procedures, templates, guidance materials, and roadmaps related to the risk register and associated governance processes. Ensure documentation is current, well organized, and easily accessible.
• Ensure cybersecurity risk management practices and risk documentation align with recognized frameworks and regulatory expectations, including NIST Cybersecurity Framework (CSF), ISO/IEC 27001, HIPAA Security Rule, HITRUST CSF, SOC 1 / SOC 2, and ARC AMPE, as applicable to Centene’s operating environment.
• Promote a culture of transparency, accountability, and risk aware decision making by delivering high quality, timely, and customer focused risk insights in a complex, multi stream, and high pressure enterprise environment consistent with EPSRM’s mission and values. 
• Performs other duties as assigned.
• Complies with all policies and standards.

Education/Experience: Bachelor's degree in IT, MIS, Accounting, Finance, Business Administration, related field or equivalent experience. 4+ years of combined auditing and IT controls design experience. Knowledge of IT systems and processes and experience evaluating internal technical control systems required.

Technical Skills:

• 4+ years of experience in enterprise risk management, operational risk, cybersecurity governance, risk and compliance (GRC), audit, or related disciplines within a large or regulated enterprise environment (required).
• Demonstrated hands on experience managing, administering, or materially contributing to a formal cybersecurity or technology risk register, including risk intake, documentation, reporting, and lifecycle management (required).
• Strong working knowledge of risk assessment methodologies, risk taxonomies, and core risk concepts such as inherent risk, residual risk, risk appetite, risk tolerance, and risk treatment strategies (required).
• Demonstrated understanding of the cybersecurity risk management lifecycle, including risk identification, assessment, prioritization, treatment, monitoring, and reporting, as well as familiarity with upstream and downstream dependencies across security, technology, and business functions (required).
• Experience supporting GRC related initiatives or projects beyond steady state operations, such as framework alignment, audit readiness activities, tooling enhancements, metrics initiatives, or process improvements (preferred).
• Experience using Archer or comparable GRC platforms to manage risk data, workflows, and reporting (strongly preferred).
• Proven ability to work cross functionally, facilitate discussions with senior and executive level stakeholders, and translate complex technical or operational risks into clear, concise, and decision relevant insights.
• Strong written and verbal communication skills, with the ability to produce executive level reporting, dashboards, and documentation suitable for leadership, auditors, and regulators.

Licenses/Certifications: CISSP, Security+, CISM, CISA, CGEIT, or CRISC required.

Pay Range: $87,700.00 - $157,800.00 per year

At Centene, we connect people to the care they need to live healthier lives — and the work you do here makes that impact real every day. You’ll take on meaningful challenges that directly support individuals, families, and communities, building your skills while making healthcare more accessible and effective. It’s work with a purpose you can see, backed by a team committed to improving lives well beyond the workday.
 

Centene offers a comprehensive benefits package including: competitive pay, health insurance, 401K and stock purchase plans, tuition reimbursement, paid time off plus holidays, and a flexible approach to work with remote, hybrid, field or office work schedules.  Actual pay will be adjusted based on an individual's skills, experience, education, and other job-related factors permitted by law, including full-time or part-time status.  Total compensation may also include additional forms of incentives. Benefits may be subject to program eligibility.

Centene is an equal opportunity employer that is committed to diversity, and values the ways in which we are different. All qualified applicants will receive consideration for employment without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, disability, veteran status, or other characteristic protected by applicable law.

Qualified applicants with arrest or conviction records will be considered in accordance with the LA County Ordinance and the California Fair Chance Act