IT Security Risk Analyst II

Responsibilities

• Own and execute end-to-end third-party and supplier risk assessments using NIST 800-171 and similar frameworks
• Independently scope assessments by identifying data flows, CUI exposure, and inherent risk
• Review and analyze vendor evidence including SOC 2 Type II reports, ISO 27001 certifications, and SIG responses
• Evaluate security controls across infrastructure, applications, and cloud environments such as AWS and Azure
• Deliver actionable risk assessment reports and executive summaries for leadership
• Partner with business units to translate technical risks into business impact and guide remediation efforts
• Conduct OSINT research to inform third-party security profiles

Requirements

• Bachelor's degree in Cybersecurity, Information Security, Computer Science, or a related field
• 3+ years of experience in IT security or risk management with direct third-party/vendor risk ownership
• Hands-on experience evaluating SOC 2, ISO certifications, and SIG questionnaires
• Practical knowledge of cloud security controls and environments
• Strong written and verbal communication skills for technical and non-technical audiences

Preferred Qualifications

• Professional certifications such as CRISC, CISA, CISM, or CISSP
• Experience in higher education or financial services sectors
• Knowledge of FERPA and GLBA regarding sensitive data protection
• Experience with TPRM programs aligned to NIST 800-171 or CMMC

Benefits

• Medical, dental, vision, and mental healthcare
• Retirement savings plan
• Flexible paid time off and flexible paid sick time
• 11 paid holidays and up to 12 weeks of parental leave
• Discounted WGU tuition

About the Company

Western Governors University (WGU) is a leading accredited online university dedicated to expanding access to higher education through innovative, competency-based degree programs.