[Remote] Risk Analyst

Note: The job is a remote job and is open to candidates in USA. Alera Group is a national insurance brokerage and financial services organization with corporate teams supporting colleagues and clients across the country. The Risk Analyst will perform third-party security and compliance risk assessments, coordinate user access reviews, document findings and remediation plans, and support governance, audits, and compliance activities. The role will also develop risk reporting and improve risk management processes, controls, governance, and automation.

Responsibilities

• Perform third-party security and compliance risk assessments for new and existing vendors, evaluating risk exposure, control effectiveness, business impact, and remediation requirements
• Review SOC reports, security questionnaires, audit documentation, certifications, and other evidence to identify control gaps and potential business impacts
• Coordinate and execute user access reviews, validating access appropriateness and ensuring identified issues are remediated promptly
• Document risks, findings, recommendations, and remediation plans while maintaining accurate records within governance, risk, and compliance platforms
• Serve as a trusted advisor to stakeholders by asking thoughtful questions, identifying underlying business needs, assessing potential risks, and translating ambiguous requests into clear risk assessment, governance, and compliance activities
• Partner with Information Security, Technology, Legal, Procurement, and business stakeholders to identify requirements, resolve risk and compliance issues, and drive effective risk-based decision-making
• Support internal and external audits, regulatory examinations, and compliance activities through evidence collection and documentation management
• Develop risk metrics, reporting, and dashboards that drive visibility, support decision-making, and measure the effectiveness of third-party risk and governance programs
• Identify opportunities to improve risk management processes, controls, reporting, governance practices, and automation capabilities

Skills

• 5+ years of experience in cybersecurity risk, IT risk, information security, governance, risk and compliance (GRC), third-party risk, IT audit, or a related field
• Hands-on experience performing third-party or vendor security risk assessments
• Experience coordinating or performing user access reviews, access certifications, or identity governance activities
• Familiarity with cybersecurity and compliance frameworks such as NIST CSF, SOC 2, CIS Controls, HIPAA, or similar standards
• Strong analytical, critical thinking, and communication skills with the ability to evaluate complex situations, identify underlying business and risk requirements, and effectively communicate recommendations to both technical and non-technical audiences
• Experience working with GRC, ticketing, identity governance, or third-party risk management platforms
• Exercise sound judgment when evaluating risk scenarios, identifying gaps in information, and determining appropriate next steps, stakeholders, and remediation activities
• Experience within a regulated industry such as insurance, financial services, or healthcare
• Experience supporting SOC 2, HIPAA, NYDFS, or similar regulatory and compliance programs
• Experience with automated identity governance, access certification, or third-party risk management solutions
• Experience supporting internal or external security and compliance audits
• Ability to independently research requirements, develop risk-based recommendations, and communicate findings to stakeholders
• Demonstrated ability to gather and clarify ambiguous requirements, ask effective probing questions, and develop practical risk-based solutions in collaboration with business stakeholders
• CISA, CGRC or equivalent preferred

Benefits

• Bonus eligible
• Medical, dental, and vision insurance
• Life and disability coverage
• 401(k)
• Generous paid time off
• Professional development and career growth opportunities
• Remote work arrangement
• Role-specific learning paths
• Leadership development programs
• Technical and compliance training
• Industry certifications and continuing education support
• Peer learning and knowledge-sharing communities

Company Overview