Sr. GRC Risk Analyst

Description

WHO WE ARE

Come join the company at the center of how the world adopts AI securely. Cyera’s mission is to give enterprises the confidence to embrace AI safely - deciding exactly what it can see and do as it reaches deeper into the business. We started by solving the hardest problem in data security: finding and securing data faster and more precisely than anyone thought possible. That foundation is now the essential AI trust infrastructure for the Fortune 1000. We’re hiring mission-driven talent to put those leaders at the center of our story.

THE OPPORTUNITY

We are hiring a Senior GRC Analyst- Risk to build and run Cyera's enterprise risk register. You will design the risk management framework, own the full risk lifecycle from identification to closure, and turn risk data into clear decisions for leadership. This is a builder role: you will set the foundation, then operate it at scale as Cyera grows.

You will report to the GRC Manager and work closely with Security, Engineering, IT, Legal, Privacy, Finance, and business leaders.

RESPONSIBILITIES:

Build the framework

• Design and document Cyera's enterprise risk management methodology, including risk taxonomy, scoring model (likelihood and impact), risk appetite and tolerance thresholds, and treatment options
• Align the program to recognized frameworks such as ISO 27001, NIST CSF and NIST 800-30, SOC 2, and ISO 42001 for AI risk
• Establish risk ownership, RACI, escalation paths, and governance cadence with the GRC Manager and leadership
• Standardize risk register structure, naming conventions, and ID nomenclature so risks are consistent and audit-ready

Operate the risk register

• Own the enterprise risk register end to end: identification, assessment, treatment, monitoring, acceptance, and closure
• Run recurring risk assessments and workshops with control owners and business stakeholders
• Track treatment plans, remediation due dates, and risk acceptances, and follow up with owners to keep work moving
• Map risks to controls, policies, audit findings, vendor risks, and incidents so the register reflects the full picture
• Maintain evidence and documentation that supports internal and external audits

Report and influence

• Produce risk reporting and dashboards for the GRC Manager, CISO, and governance committees, including top risks, trends, and KRIs
• Translate technical and operational risk into clear business language for executives
• Prepare risk inputs for audits, customer security reviews, and board or leadership updates

Improve and scale

• Automate intake, scoring, and reporting through GRC tooling and simple workflows (Jira, GRC platforms, spreadsheets) before adding complexity
• Integrate risk management with TPRM, vulnerability management, incident response, AI governance, and change management
• Train risk owners and build reusable templates, guides, and playbooks

Requirements

REQUIRED QUALIFICATIONS:

• 3 to 5 years of experience in GRC, IT risk, information security risk, or enterprise risk management
• Hands-on experience building or significantly maturing a risk register and risk assessment process, not just maintaining one
• Working knowledge of at least two of ISO 27001, NIST CSF, NIST 800-30, NIST 800-53, or SOC 2
• Strong grasp of risk scoring, risk appetite, treatment, and acceptance, and the judgment to apply them practically
• Experience mapping risks to controls and supporting external audits
• Ability to run risk conversations with engineers and executives, and to hold owners accountable without slowing the business
• Clear, concise writing and reporting skills
• Comfort working in a fast-moving SaaS or cloud environment with changing priorities
• Bachelor's degree in a related field, or equivalent experience

Nice to have

• Certifications such as CRISC, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, or ISO 31000 Risk Manager
• Experience with GRC platforms (for example Anecdotes, Drata, Vanta, ServiceNow IRM, or Archer) and Jira workflows
• Exposure to AI risk management, ISO 42001, or the EU AI Act
• Familiarity with multi-framework environments such as PCI DSS, FedRAMP, C5, or ENS
• Experience at a security or data security vendor
• Data Privacy and Protection experience

COMPENSATION INFORMATION:

Compensation Range: $100,000 - $120,000.

The range represents total compensation, and may include incentive for sales roles, equity or benefits, as applicable.

This compensation range represents Cyera’s good faith and reasonable estimate of the range of possible compensation for this role at the time of posting, and Cyera may ultimately pay more or less than the posted range. The final salary for this position will be determined in Cyera’s sole discretion, consistent with applicable law, and based on a variety of factors, including but not limited to the employee’s work experience, skills, and qualifications for the role, as well as the needs of Cyera’s business and other operational considerations.

Final compensation will vary based on seniority and relevance of experience, location, and position requirements.

This role may be eligible for potential merit increases based on factors such as individual or company performance, time in role, and other discretionary factors. In addition to a standard benefits and equity package, we offer a generous salary. Final compensation will vary based on seniority and relevance of experience, location, and position requirements.

This role may be eligible for potential merit increases based on factors such as individual or company performance, time in role, and other discretionary factors.

BENEFITS - Why Cyera?

• Ability to work remotely, with office setup reimbursement
• Unlimited PTO
• Paid holidays and sick time
• Health, vision, and dental insurance
• Life, short and long-term disability insurance