The SRA analyst plays a critical role in protecting the organization against internal and external security threats. This role is responsible for managing the SRA process and executing SRAs. It includes running the intake process, triaging requested assessments, executing assessments, and ensuring that findings are appropriately logged in the respective systems of record.

The SRA analyst will evaluate requested topics of assessment for inherent security risk, potential mitigations, residual security risk, and for any recommendations and/or findings that might result from the assessment. They partner with assessment stakeholders, control owners, system owners, and various other stakeholders to ensure assessments are completed accurately, on time, and in alignment with enterprise risk standards.

SRAs are generally executed over complex, broad topics on an as-requested basis. Examples of potential assessment categories include onboarding a new system, entering a new market, a particular control or oversight gap, or other situational circumstances. This is a complex, challenging role, and requires very strong problem-solving skills and the ability to make sense of ambiguous, blurry projects to arrive at actionable insights.

In addition to executing assessments, the SRA Analyst is also responsible for maintaining procedure documentation, process flows, and control documentation associated to the SRA process.

The role offers a hybrid/flexible schedule, which means there’s an in-office expectation of 3 or more days per week and the flexibility to work outside the office location for the other days at one of the following locations:

• Minneapolis, MN

• Atlanta, GA

• Cincinnati, OH

• Charlotte, NC

• Irving, TX

• Denver, CO

Responsibilities

• Intake and triage requested SRAs to the appropriate analyst and/or other assessment team.
• Review requested topics for inherent and residual risk, to include assessment of control coverage and other mitigations.
• Ensure findings from the assessment are appropriately logged in the system of record.
• Contribute to the refinement of SRA methodology and process steps.
• Strive for operational excellence for the SRA team.
• Communicate the results of SRAs to senior leadership, sometimes including executives.
• Prepare documentation, memos, and summaries to describe the results of the SRA.

Preferred Skills/Experience

• Typically a Bachelor's degree, or equivalent work experience
• Typically five or more years of relevant experience
• Effective communication and collaboration skills
• Ability to articulate complex technical issues in a clear and concise manner

Additional Skills/Experience

• At least one relevant certification, such as CISSP, CISA, CRISC, CISM, etc.
• Excellent written and verbal executive communication skills.
• Strong knowledge of risk management and control design concepts.
• Working knowledge of technology and cloud fundamentals.
• Desire to self-improve and continuously learn.
• Understanding of basic concepts of business management, including cost benefit analysis and other forms of business sense.
• High level of discipline and organization.
• Strong decision-making and problem-solving skills.
• System-level thinking, with an ability to connect topics and understand interactions and relationships among programs and processes.
• Excellent skills in risk assessment domains.
• High degree of comfort with working through ambiguous, complex problems.