Information Security Risk & Vulnerability Management Analyst

The Information Security Risk & Vulnerability Management Analyst is an individual contributor responsible for executing cybersecurity risk management, vulnerability management, and control assurance activities across the JFG enterprise. This role supports the identification, assessment, prioritization, and remediation of technology risks and vulnerabilities in alignment with JFG's risk tolerance, regulatory expectations, and internal control standards. The analyst performs risk analysis, control validation, vulnerability lifecycle management, and remediation coordination to help reduce overall cyber risk exposure.

Working under the direction of the Information Security Risk & Resiliency Manager, this position operationalizes cyber risk governance processes, including issues and exceptions management, audit support, control effectiveness validation testing, and risk reporting. The analyst operates across multiple security domains, with a primary focus on cyber risk management and vulnerability management, while supporting resilience and post-incident improvement activities. In collaboration with IT, Enterprise Risk Management, Internal Audit, and business stakeholders, this role translates technical findings into business-aligned risk insights and drives remediation outcomes.

This position requires strong analytical capability, cross-functional collaboration, and the ability to communicate risk in both technical and business terms. The role is supported by third-party services and enterprise tools, with occasional off-hours support required. Minimal travel less than 5% is expected.

KEY RESPONSIBILITIES

* Perform cyber risk assessments, control testing, and risk analysis across infrastructure, applications, and business processes
* Execute and maintain cyber risk issues and exceptions lifecycle, including identification, documentation, tracking, and remediation validation
* Support risk exception and risk acceptance workflows, including preparation of analysis, documentation, and impact summaries
* Assist in audit coordination, regulatory support, and control compliance activities, including evidence collection and documentation
* Translate technical findings into business-aligned risk insights for reporting and decision-making
* Contribute to third-party / supply chain risk assessments, including risk scoring and remediation tracking
* Execute enterprise vulnerability scanning, analysis, and reporting across infrastructure, cloud, and applications
* Identify and assess configuration weaknesses, security gaps, and exposure risks
* Perform risk-based prioritization using severity, exploitability, business impact, and other factors as appropriate
* Coordinate with IT and application teams to drive remediation and validate closure evidence
* Maintain system-of-record accuracy for vulnerability tracking and reporting
* Support application security testing (SCA/SAST/DAST) coordination and findings management
* Execute technical control testing and validation activities under defined standards
* Collect and maintain audit evidence to support control assurance and audit readiness
* Produce operational metrics, dashboards, and reporting to support management decision-making
* Assist in mapping controls to frameworks and regulatory requirements (e.g., CIS Controls)
* Identify and document control gaps, inconsistencies, and process improvement opportunities
* Support post-incident remediation tracking and integration into risk and issues management processes
* Assist in gathering inputs for business impact analysis (BIA) and resiliency assessments
* Document and track corrective actions, lessons learned, and control improvements from incidents, exercises, and reviews
* Partner with IT, ERM, Audit, Vendor Management, and business teams to integrate cyber risk into enterprise processes
* Participate in incident follow-up activities to ensure control gaps are addressed
* Automate risk, reporting, and vulnerability management workflows using enterprise tools as appropriate
* Contribute to continuous improvement of risk and vulnerability management processes, standards, and runbooks
* Operate as a cross-functional security analyst supporting GRC, vulnerability management, and technical risk functions
* Demonstrate strong business acumen and stakeholder engagement
* Communicate effectively with both technical and non-technical audiences
* Develop broad, multi-domain security knowledge aligned to modern cybersecurity workforce expectations
* Perform other duties as assigned.

Our Associates are expected to willingly accept new responsibilities to support our success; this includes either taking on new tasks or learning new skills in order to meet business and organizational goals.

JOB REQUIREMENTS - EDUCATION, KNOWLEDGE, AND SKILLS

• Level 1
• Education:
  • (Desired) Bachelor's Degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
• Experience:
  • 2-5 years' experience
  • Cybersecurity Certifications (Preferred):
  • Microsoft AZ-500, GIAC-GCIH/GCIA/GCFE/GMON/GPEN, Security+, CEH, SSCP, JFG InfoSec Platforms
  • Types of preferred certifications: Microsoft AZ-500, GIAC-GCIH/GCIA/GCFE/GMON/GPEN, Security+, CEH, SSCP, JFG InfoSec Platforms
• Other Experience:
  • Experience with Python and PowerShell scripting languages for automation preferred.
  • Works with some supervision
  • Strong report writing and communication skills.
  • Has strong understanding of Information Security platforms at JFG.
  • Has strong understanding of common Information Security controls and frameworks.
  • Has an intermediate understanding of networking concepts and technologies.
  • Has an intermediate understanding of Windows and Linux environments.
  • Can operate beyond instruction and guidelines where needed.
  • Has a basic understanding of financial services industry and can apply operational analysis to understand and communicate the threat.
  • Can revise existing processes/standards as needed.
• Level 2
• Education:
• (Desired) Bachelor's Degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
• Experience:
  • 5-8 years' experience
  • Cybersecurity Certifications (Preferred):
  • SANS GIAC Certifications in Digital Forensics (GCFE, GCFA, GCFR, GNFA), Offensive Operations (GCIH, GWAPT, GPEN, GCPN, GXPN), Cyber Defense (GSEC, GCIA, GMON, GDSA, GCDA), Cloud Security (GCLD, GWEB, GCSA, GAIPS, GCAD), and Security Leadership (GSLC, GSTRT, GCIL)
  • CompTIA CySA+, PenTest+, CASP+, SecurityX
  • ISC2 CISSP, CCSP
  • ISACA CISM
  • EC-Council CEH
• Other Experience:
  • Experience with Python and PowerShell scripting languages for automation preferred.
  • Works without supervision
  • Expert report writing and communication skills.
  • Strong collaboration skills to work with other IS and IT engineers and business partners to solve problems effectively.
  • Has strong understanding of Information Security platforms at JFG.
  • Has strong understanding of common Information Security controls and frameworks.
  • Has a strong understanding of networking concepts and technologies.
  • Has a strong understanding of Windows and Linux environments
  • Can operate beyond instruction and guidelines where needed.
  • Has strong understanding of both cybersecurity industry and financial services industry allowing them to revise existing processes/standards or establish new processes/standards as needed.
  • Takes complete ownership of all RunBook, support, and process documentation for their service portfolio.
• Level 3
• Education:
  • (Desired) Bachelor's Degree in Information Security, Cybersecurity, Computer Science, Information Systems, or related field
• Experience:
  • 8+ years' experience
  • Cybersecurity Certifications (Preferred):
  • SANS GIAC Certifications in Digital Forensics (GCFE, GCFA, GCFR, GNFA), Offensive Operations (GCIH, GWAPT, GPEN, GCPN, GXPN), Cyber Defense (GSEC, GCIA, GMON, GDSA, GCDA), Cloud Security (GCLD, GWEB, GCSA, GAIPS, GCAD), and Security Leadership (GSLC, GSTRT, GCIL)
  • CompTIA CySA+, PenTest+, CASP+, SecurityX
  • ISC2 CISSP, CCSP
  • ISACA CISM
  • EC-Council CEH
• Other Experience:
  • Strong scripting and automation skills with PowerShell o python for automation preferred.
  • Works without supervision
  • Capable of guiding the work of others.
  • Expert report writing and communication skills.
  • Can develop operational dashboards.
  • Has expert understanding of Information Security platforms at JFG.
  • Has expert understanding of common Information Security controls and frameworks.
  • Has a strong understanding of networking concept and technologies.
  • Has a strong understanding of Windows and Linux environments
  • Can develop instructions and guidelines where needed.
  • Has expert understanding of cybersecurity industry and strong understanding of financial services industry allowing them to revise existing processes/standards or establish new processes/standards as needed.
  • Able to identify operational capability gaps and establish a roadmap/strategy to address them.

Johnson Financial Group supports and is committed to the principle of equal employment opportunity. We make all employment-related decisions without regard for an individual's race, color, religion, sex, sexual orientation, age, national origin, citizenship, disability, veteran status, or any other protected status as required by law.