[Hiring] Information Security Manager 3 – GRC Risk Register Analyst @Nexiva

Role Description

Seeking an experienced Information Security Manager 3 – GRC Risk Register Analyst to design, establish, and operationalize an enterprise cybersecurity and technology risk register framework. The ideal candidate will have strong experience in:

• Risk register design
• Risk scoring and prioritization
• Governance processes
• Stakeholder engagement
• Documentation and knowledge transfer

The candidate will work closely with business, technology, security, and governance stakeholders to establish effective risk management workflows and ensure the organization's risk posture is documented and managed in an audit-ready manner.

Qualifications

• Minimum of 8 years of experience in Risk Register Design and Framework
• Minimum of 8 years of experience in Risk Scoring and Prioritization Models
• Minimum of 8 years of experience in Governance Processes and Workflows
• Minimum of 8 years of experience in Stakeholder Engagement and Enablement
• Minimum of 8 years of experience in Documentation and Knowledge Transfer

Requirements

• Enterprise Risk Management
• Cybersecurity Risk Management
• GRC
• Risk Register Development
• Risk Identification and Assessment
• Risk Scoring and Prioritization
• Risk Mitigation and Acceptance
• Governance Frameworks
• Risk Monitoring and Reporting
• Stakeholder Management
• Process Design
• Workshop Facilitation
• Audit-Ready Documentation
• Knowledge Transfer
• Security Governance

Expected Deliverables

• Enterprise Risk Register Framework
  • Standardized risk register template
  • Risk taxonomy
• Risk Scoring and Prioritization Model
  • Likelihood and impact scales
  • Scoring methodology
  • Risk prioritization logic
• Risk Governance Model
  • Risk intake, review, acceptance, and monitoring workflows
  • Roles and responsibilities matrix
• Initial Risk Register Population
  • Initial set of documented risks representing the current cybersecurity and technology risk posture
• Final Documentation Package
  • Consolidated guidance
  • Operating procedures for ongoing risk management