Cybersecurity Risk Analyst - Third Party & Internal Risk

Job Title: Cybersecurity Risk Analyst - Third Party & Internal Risk
Primary Location: Northbrook, IL - Hybrid, 3 Days in Office
Position Type: Contract-to-Hire - W2 Contract to Start

Overview
TalentFish is casting a line for a Cybersecurity Risk Analyst. This hybrid, contract-to-hire opportunity in Northbrook, IL supports cybersecurity risk assessments across technologies, business initiatives, and third-party providers.

The role is approximately 50% vendor/third-party risk and 50% internal risk assessment work, with an initial focus on coordinating vendor assessments with existing contractors. The ideal candidate can independently manage assessments from intake through recommendations and remediation support, communicate business risk clearly, and manage competing priorities with minimal supervision.

Laptop, monitors, and headset will be provided.

What You Bring to the Role. (Required Experience)

• Bachelor's or master's degree in Business, Computer Science, Cybersecurity, Information Security, or a related field.

• 4+ years of relevant cybersecurity, information security, technology risk, or risk management experience.

• At least 2 years managing risk and compliance matters or supporting technologies, services, projects, systems, or third-party relationships involving risk identification, assessment, remediation, and monitoring. This experience may overlap with the requirement above.

• Proven ability to independently conduct cybersecurity risk assessments with minimal supervision, including identifying risks, evaluating controls, documenting conclusions, and recommending risk treatment.

• Hands-on understanding of vendor/third-party and internal risk assessment processes, with the ability to manage the assessment lifecycle from intake through remediation follow-up.

• Experience applying FAIR and NIST risk assessment methodologies, including quantitative and qualitative approaches; familiarity with ISO/IEC 27001.

• Ability to evaluate control design and implementation and assess inherent and residual risk.

• Ability to translate technical security concerns into clear business risk statements and communicate findings to business and risk owners.

• Experience documenting risks and findings, maintaining risk registers, and tracking remediation with stakeholders.

• Strong analytical judgment, organization, and follow-through, with the ability to manage high assessment volume and competing priorities in a fast-moving environment.

• Hands-on ServiceNow experience managing vendor risk assessments and risk workflows is strongly preferred. An experienced risk analyst with strong assessment process knowledge may be considered without ServiceNow if able to learn the platform quickly with minimal assistance.

• Familiarity with additional frameworks ISO/IEC 27001, COBIT, NIST Cybersecurity Framework, NIST SP 800-series, and FAIR

• CISSP, CISM, or CISA certification. Certifications are not required but nice to have!

What You'll Do. (Skills Used in This Position)

• Independently conduct and manage cybersecurity and information risk assessments for technologies, services, business initiatives, and third-party providers.

• Divide responsibilities approximately equally between vendor/third-party risk and internal assessments.

• Initially prioritize vendor assessments, coordinating existing contractors and managing the assessment process from the internal business perspective.

• Own assessments from intake through analysis, recommendations, stakeholder communication, and remediation support.

• Identify and document risk scenarios, including assets, threats, vulnerabilities, controls, likelihood, and business impact.

• Develop clear risk statements and distinguish risks from issues/findings and control deficiencies within the risk register.

• Evaluate controls, recommend risk treatment, and assess residual risk after mitigating or compensating controls are implemented.

• Track risks, findings, and remediation activities through closure, maintaining consistent follow-up with stakeholders.

• Support exception management requests and related stakeholder coordination.

• Support third-party due diligence, control validation, ongoing monitoring, and remediation tracking.

• Communicate assessment results promptly and provide reporting that highlights material risks and outstanding remediation.

• Support responses to external customer security questionnaires and apply relevant legal, regulatory, contractual, and industry requirements when evaluating risks.

Compensation Information
The expected salary range for this position is $40 - $56 per hour, depending on experience and qualifications. This role also qualifies for comprehensive benefits such as health insurance and paid time off. TalentFish is committed to pay transparency and equal opportunity. The salary range provided is in compliance with applicable state and federal regulations.

This role requires authorization to work in the U.S. without current or future visa sponsorship.

All offers are contingent upon the completion of a background check, which may include but is not limited to reference checks, education verification, employment verification, drug testing, criminal records checks, and any required certifications or compliance requirements based on the end client's background check policies and applicable laws.

TalentFish is an employee-owned company pioneering a new realm in talent acquisition. We are redefining IT staffing by evolving AI, video screening, and our unique platform. TalentFish focuses on providing the best employee, consultant, and client experience possible.
At TalentFish we are an Equal Opportunity Employer; we embrace and encourage diversity!