Cyber Risk Analyst

This position is listed on behalf of a partner company, which manages all applications and next steps. Our partner is looking for a Cyber Risk Analyst based in India. Join a mission-driven, technology-focused organization where cybersecurity and risk management are essential to protecting business operations and enabling sustainable growth. As a Cyber Risk Analyst, you will strengthen the organization's governance, risk, and compliance framework through security audits, third-party assessments, and business continuity testing. You will help identify vulnerabilities, evaluate risks, and coordinate remediation efforts to improve the organization's security posture. Working closely with technical teams, business stakeholders, and external vendors, you will translate security requirements into practical controls and measurable improvements. You will also contribute to the implementation of recognized frameworks, including NIST Cybersecurity Framework and ISO 27001, while supporting disaster recovery readiness and security awareness initiatives. This opportunity is ideal for a proactive cybersecurity professional who enjoys cross-functional collaboration, clear communication, and taking ownership of risk reduction in a dynamic, international environment.

Cybersecurity audits and assessments: Plan and conduct internal cybersecurity audits and control reviews across applications, infrastructure, and business processes. Document findings, evaluate potential impacts, and coordinate remediation activities with relevant teams through to closure. Vendor and third-party risk management: Perform security due diligence for vendors and external partners by reviewing security questionnaires, certifications, policies, and technical controls. Identify potential risks, recommend mitigation measures, and support the inclusion of appropriate security requirements in contracts when necessary. Business continuity and disaster recovery: Collaborate with stakeholders to maintain, validate, and improve business continuity and disaster recovery (BCP/DR) plans. Organize tabletop exercises and technical drills, document outcomes, and track corrective actions to completion. Cyber governance and compliance: Maintain and improve security policies, standards, procedures, and guidelines, ensuring alignment with NIST Cybersecurity Framework, ISO 27001, and applicable regulatory requirements. Risk assessment and treatment: Maintain the cybersecurity risk register and work with control owners and business stakeholders to identify, assess, and prioritize risks. Evaluate likelihood and impact, recommend appropriate treatment strategies, and monitor mitigation plans through resolution. Management reporting: Prepare reports and dashboards covering audit findings, risk exposure, vendor security assessments, business continuity exercise results, and progress toward ISMS and NIST CSF objectives. Security awareness and training: Develop and deliver employee awareness sessions and targeted training on topics such as phishing prevention, secure data handling, and role-specific security responsibilities. Security communications: Create clear, engaging awareness materials, including presentations, FAQs, and quick-reference guides, to encourage secure behaviors and strengthen the organization's security culture. Continuous improvement: Identify opportunities to improve security controls, governance processes, risk reporting, and cross-functional collaboration while supporting the effective implementation of cybersecurity standards and best practices. Requirements A bachelor's degree in an engineering discipline. At least three years of professional experience in cybersecurity governance, risk, and compliance (GRC). Practical experience implementing security controls and processes across business functions in alignment with frameworks such as NIST Cybersecurity Framework and ISO 27001. Hands-on experience with a substantial portion of the responsibilities outlined for this role, ideally including security audits, third-party risk assessments, business continuity planning, and risk management. Familiarity with relevant industry standards and regulatory requirements, such as SOC 2, ISO 27001, GDPR, and India's Digital Personal Data Protection (DPDP) framework. The ability to conduct structured risk assessments, document findings, recommend mitigation strategies, and coordinate remediation activities with multiple stakeholders. Strong analytical and problem-solving skills, with the ability to assess technical and operational risks and translate findings into actionable recommendations. Excellent written and verbal communication skills, including the ability to explain cybersecurity concepts and compliance requirements to both technical and non-technical audiences. Strong interpersonal and stakeholder management skills, with the ability to collaborate across departments and engage effectively with vendors and control owners. A proactive, organized, and accountable working style, with the ability to manage multiple priorities and work independently in a remote environment. Preferred certifications: CISA, ISO 27001 Lead Implementer, or ISO 27001 Lead Auditor. Additional advantage: Training or certifications in AI governance and AI risk management, such as ISO/IEC 42001, NIST AI Risk Management Framework (AI RMF), or recognized AI security and governance programs. Benefits Fully remote work: Work remotely from India. Permanent, full-time employment: An opportunity to build a long-term career in cybersecurity governance, risk management, and compliance. Professional growth: Develop expertise in security audits, vendor risk management, business continuity, and recognized cybersecurity frameworks. Learning and development: Access to structured development opportunities designed to strengthen professional, leadership, and management capabilities. Collaborative culture: Work with colleagues across technical and business functions in an open-minded, innovation-focused environment. International exposure: Collaborate with professionals from different countries, cultures, and backgrounds. Purpose-driven work: Contribute to an organization focused on expanding access to affordable, reliable energy and delivering positive social and environmental impact.