{"id":1614941,"url":"https://alion.io/job/ufcu-associate-cyber-risk-analyst","title":"Associate Cyber Risk Analyst","company":{"id":1789412,"name":"UFCU","domain":"ufcu.org","url":"https://alion.io/company/ufcu","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"UltiPro","truth_index":null},"role":"Security","role_family":"Security","seniority":"junior","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Austin, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":68000,"max_usd":140000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":297},"experience_years_min":2,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Microsoft Excel","optional":false},{"name":"Power BI","optional":false},{"name":"SharePoint","optional":false}],"status":"live","first_seen_at":"2026-09-28T22:41:38Z","employer_posted_date":"2026-10-09","last_verified_at":"2026-10-17T17:53:27Z","board_verified":true,"closed_at":null,"days_open":18,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":18},"description":"Job Summary\nThe Associate Cyber Risk Analyst coordinates governance, risk, and compliance activities that support UFCU’s cybersecurity program. This role organizes participation in internal audits and third-party due diligence, maintains cybersecurity program knowledge and records, coordinates the development and lifecycle of security processes and procedures, and administers the security awareness training and phishing exercise program. The Associate Cyber Risk Analyst partners with Information Security, Risk Management, Internal Audit, Compliance, Legal, Human Resources, Technology, and business teams to collect evidence, track commitments, improve documentation, and promote secure behaviors across the organization.\nThe Associate Cyber Risk Analyst is an exempt position and reports to the Director, Information Security, and is part of the Information Security team at UFCU.\nAbout UFCU\nOur Credit Union was founded in 1936 and has grown to serve members throughout Texas and beyond. At UFCU, we are more than just a financial institution, and our people are more than just employees. We are dedicated to our purpose of empowering our Members to achieve financial success and build brighter futures.\nIn pursuit of our aspiration that UFCU is loved by millions of Members and built to thrive for generations, we are guided by our values:\nPurposefully Member-Obsessed: We are driven by a profound sense of empathy to deeply understand our Members’ needs and preferences, what brighter futures means to them, and the obstacles in their way. We act in our Members’ best interests, forever seeking to empower their financial success.\nPossibilities Reimagined: We are inspired to courageously experiment, learn, and iterate in pursuit of positive impact for our Members, UFCU, and coworkers. We challenge assumptions, embrace diverse perspectives, and make use of data and insights.\nPerformance Excellence Rooted in Unwavering Integrity: We do the right thing, always. We champion teamwork, accountability, continuous improvement, and celebrate successful outcomes of others, fostering an inclusive environment of excellence and collaboration.\nEssential Functions\nAudit and Due Diligence Coordination\nCoordinate, organize, and manage Information Technology participation in internal audits, external audits, regulatory examinations, risk assessments, and control reviews.\nMaintain audit schedules, evidence inventories, request lists, stakeholder assignments, due dates, dependencies, and status reporting from initiation through closure.\nCollect, review, organize, and securely retain audit evidence to support accurate, complete, and timely responses.\nFacilitate meetings among auditors, vendors, control owners, subject matter experts, and leadership; document decisions, action items, and follow-up commitments.\nTrack findings, management responses, remediation plans, and evidence of closure; escalate delays, risks, and resource constraints to Information Security leadership.\nCybersecurity Knowledge & Information Management\nMaintain the cybersecurity program’s authoritative documentation repository, including standards, procedures, control narratives, evidence, risk records, decisions, meeting materials, metrics, and program artifacts.\nOrganize cybersecurity information using consistent taxonomy, naming, ownership, version control, retention, review dates, and access permissions.\nCoordinate recurring reviews with document owners to validate accuracy, remove obsolete content, and preserve institutional knowledge.\nPrepare dashboards, reports, presentations, and program updates that communicate cybersecurity activities, risks, trends, and commitments to technical and business audiences.\nSupport records retention, legal hold, privacy, and confidentiality requirements for cybersecurity program information.\nCybersecurity Process & Procedure Coordination\nCoordinate the development, review, approval, publication, and scheduled refresh of Information Security processes, procedures, standards, and supporting templates.\nPartner with process owners and subject matter experts to document roles, workflows, control points, inputs, outputs, dependencies, exceptions, and evidence requirements.\nFacilitate workshops and working sessions to identify gaps, resolve conflicting requirements, and align documentation with policy, risk, regulatory, and operational needs.\nMaintain document inventories, ownership assignments, approval records, revision history, review cadence, and exceptions.\nMonitor process adoption and effectiveness; recommend improvements based on audit results, incidents, metrics, stakeholder feedback, and changes in the threat or regulatory environment.\nSecurity Awareness Training & Phishing Exercises\nAdminister the enterprise security awareness and training program, including annual training, role-based learning, new-hire content, targeted campaigns, and recurring communications.\nPlan and execute periodic phishing simulations with approved scenarios, audience groups, schedules, safeguards, and escalation paths.\nMaintain training assignments, completion records, exceptions, reminders, and evidence required for audits and regulatory reviews.\nAnalyze training and phishing results, identify trends and higher-risk populations, and coordinate appropriate coaching, follow-up learning, and corrective actions.\nDevelop program communications, metrics, and leadership reporting; evaluate content and platform effectiveness and recommend enhancements that strengthen security culture.\nOther\nAdheres to all company policies, procedures, and business ethics codes.\nCompletes required regulatory training as assigned.\nMaintains strict adherence to and compliance with all laws, rules, regulations, and internal controls specific to the role, including but not limited to Bank Secrecy Act, Anti-Money Laundering, USA Patriot Act, Office of Foreign Assets Control, and Fair Lending regulations.\nKnowledge/Skills/Abilities\nThis is an intermediate-level role and requires a competent level of knowledge, skill, and ability.\nKnowledge\nCompetent knowledge of cybersecurity governance, risk, compliance, audit, and control concepts.\nKnowledge of audit evidence practices, issue remediation, control testing, records management, policy governance, and document lifecycle management.\nKnowledge of cybersecurity and financial-services frameworks and requirements, such as the National Institute of Standards and Technology Cybersecurity Framework, National Credit Union Administration guidance, Gramm-Leach-Bliley Act, Federal Financial Institutions Examination Council guidance, and Payment Card Industry Data Security Standard.\nFamiliarity with security awareness principles, adult learning concepts, phishing simulation practices, and security culture measurement.\nSkills\nProject coordination skills, including planning, scheduling, dependency management, action tracking, status reporting, and meeting facilitation.\nClear business and technical writing skills for developing processes, procedures, control narratives, audit responses, presentations, and program communications.\nInformation organization and records-management skills, including taxonomy, version control, document ownership, review cycles, retention, and access management.\nData analysis and reporting skills using Microsoft Excel, Power BI, or similar tools to develop meaningful metrics and dashboards.\nProficiency with Microsoft 365 collaboration tools and experience administering governance, risk, compliance, audit, knowledge-management, or security-awareness platforms.\nAbilities\nAbility to manage multiple concurrent requests, deadlines, and stakeholders while maintaining attention to detail and accurate records.\nAbility to translate cybersecurity, audit, and compliance requirements into practical activities and clear communications.\nAbility to build cooperative relationships and influence control owners and cross-functional partners without direct authority.\nAbility to handle confidential or sensitive information with discretion and apply sound judgment when escalating risks or delays.\nAbility to identify process gaps, recommend improvements, and follow work through to measurable completion.\nCore Competencies\nDemonstrating Member Obsession\nPuts themselves in the Member’s shoes\nLooks for friction points\nMakes it personalized and easy\nDemonstrating Performance Excellence\nSets standards for elevating excellence\nEnsures elevated quality\nTakes responsibility\nConducts continuous improvement\nDemonstrating Innovation\nChallenges current thinking\nApproaches change with a positive mindset\nExperience\nMinimum Requirements\nBachelor’s degree in cybersecurity, information systems, business, risk management, communications, or a related field, or equivalent relevant professional experience.\n0-2 years of relevant experience in cybersecurity, governance, risk, compliance, IT audit, information security, records management, training coordination, or a related field.\nExperience developing or maintaining business or technical processes, procedures, standards, training content, or program communications.\nMust be bondable.\nPreferred Requirements\nExperience in financial services, fintech, credit unions, or another regulated industry.\n2 or more years of relevant experience in cybersecurity, governance, risk, compliance, IT audit, information security, records management, training coordination, or a related field.\nMaster’s degree in cybersecurity, information systems, business, risk management, communications, or a related field, or equivalent relevant professional experience.\nExperience supporting Information Security audits, regulatory examinations, control assessments, or issue-remediation programs.\nExperience administering a security awareness training or phishing simulation platform.\nExperience with governance, risk, and compliance platforms; document-management systems; Microsoft SharePoint; Power BI; or similar tooling.\nRelevant certification or progress toward certification, such as Certified in Cybersecurity, Security+, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, or Certified Information Security Manager.\nPhysical Demands\nThe physical demands described are representative of those that must be met by an employee, with or without accommodation, to successfully perform the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.\nFrequent\nWhile performing the duties of this job, the employee is regularly required to sit; use hands to finger, handle or feel; reach with hands and arms; and talk or hear.\nSpecific vision abilities required by this job include close vision, distance vision, peripheral vision, and ability to adjust focus.\nEmployee will make extensive use of the telephone and virtual communications requiring the ability to explain complex information effectively and accurately.\nWork Environment\nThe work environment characteristics described are representative of those an employee encounters while performing the essential functions of this job.\nThis position is hybrid, requiring working onsite at UFCU Plaza in Austin, Texas approximately two days per week, with the remaining days worked remotely.\nThis position may involve periodic stressful conditions.\nMay occasionally require an adjusted work schedule, overtime, and evening or weekend hours.\nMay occasionally move from one work location or branch to another.\nPublic contact position, requiring appropriate professional appearance.\nFrequent computer use at a workstation of up to two hours at a time.\nThe noise level in the work environment is usually moderate.","description_format":"text","description_chars":11714,"description_truncated":false,"requirements":{"experience_years_min":2,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Services","Information Security","Credit Unions & Cooperative Banks"],"lifecycle":[{"event":"open","at":"2026-10-01T20:28:41Z"}],"visa":[],"liveness":{"score":60,"band":"ok","label":"Likely open","p_open":1,"p_active":0.799,"p_room":0.75,"age_days":18,"expected_fill_days":24,"reasons":["conf:0","velocity","win:late","comp:junior"],"computed_at":"2026-10-17T05:46:00Z"},"pay":null,"html_url":"https://alion.io/job/ufcu-associate-cyber-risk-analyst","json_url":"https://alion.io/job/ufcu-associate-cyber-risk-analyst.json","meta":{"generated_at":"2026-10-17T20:35:49Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":4585,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-18T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1789412},"rest":"https://alion.io/mcp/rest/get_company?id=1789412"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fufcu-associate-cyber-risk-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fufcu-associate-cyber-risk-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fufcu-associate-cyber-risk-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ufcu-associate-cyber-risk-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fufcu-associate-cyber-risk-analyst"}]}