Associate Cyber Risk Analyst

About the Role

The Associate Cyber Risk Analyst coordinates governance, risk, and compliance activities that support UFCU’s cybersecurity program. This role organizes participation in internal audits and third-party due diligence, maintains cybersecurity program knowledge and records, coordinates the development and lifecycle of security processes and procedures, and administers the security awareness training and phishing exercise program. The Associate Cyber Risk Analyst partners with Information Security, Risk Management, Internal Audit, Compliance, Legal, Human Resources, Technology, and business teams to collect evidence, track commitments, improve documentation, and promote secure behaviors across the organization.

Key Responsibilities

• Audit and Due Diligence Coordination:
• Coordinate, organize, and manage Information Technology participation in internal audits, external audits, regulatory examinations, risk assessments, and control reviews.
• Maintain audit schedules, evidence inventories, request lists, stakeholder assignments, due dates, dependencies, and status reporting from initiation through closure.
• Collect, review, organize, and securely retain audit evidence to support accurate, complete, and timely responses.
• Facilitate meetings among auditors, vendors, control owners, subject matter experts, and leadership; document decisions, action items, and follow-up commitments.
• Track findings, management responses, remediation plans, and evidence of closure; escalate delays, risks, and resource constraints to Information Security leadership.
• Cybersecurity Knowledge & Information Management:
• Maintain the cybersecurity program’s authoritative documentation repository, including standards, procedures, control narratives, evidence, risk records, decisions, meeting materials, metrics, and program artifacts.
• Organize cybersecurity information using consistent taxonomy, naming, ownership, version control, retention, review dates, and access permissions.
• Coordinate recurring reviews with document owners to validate accuracy, remove obsolete content, and preserve institutional knowledge.
• Prepare dashboards, reports, presentations, and program updates that communicate cybersecurity activities, risks, trends, and commitments to technical and business audiences.
• Support records retention, legal hold, privacy, and confidentiality requirements for cybersecurity program information.
• Cybersecurity Process & Procedure Coordination:
• Coordinate the development, review, approval, publication, and scheduled refresh of Information Security processes, procedures, standards, and supporting templates.
• Partner with process owners and subject matter experts to document roles, workflows, control points, inputs, outputs, dependencies, exceptions, and evidence requirements.
• Facilitate workshops and working sessions to identify gaps, resolve conflicting requirements, and align documentation with policy, risk, regulatory, and operational needs.
• Maintain document inventories, ownership assignments, approval records, revision history, review cadence, and exceptions.
• Monitor process adoption and effectiveness; recommend improvements based on audit results, incidents, metrics, stakeholder feedback, and changes in the threat or regulatory environment.
• Security Awareness Training & Phishing Exercises:
• Administer the enterprise security awareness and training program, including annual training, role-based learning, new-hire content, targeted campaigns, and recurring communications.
• Plan and execute periodic phishing simulations with approved scenarios, audience groups, schedules, safeguards, and escalation paths.
• Maintain training assignments, completion records, exceptions, reminders, and evidence required for audits and regulatory reviews.
• Analyze training and phishing results, identify trends and higher-risk populations, and coordinate appropriate coaching, follow-up learning, and corrective actions.
• Develop program communications, metrics, and leadership reporting; evaluate content and platform effectiveness and recommend enhancements that strengthen security culture.

Requirements & Tech Stack

• Project coordination skills: planning, scheduling, dependency management, action tracking, status reporting, and meeting facilitation.
• Clear business and technical writing skills for developing processes, procedures, control narratives, audit responses, presentations, and program communications.
• Information organization and records-management skills: taxonomy, version control, document ownership, review cycles, retention, and access management.
• Data analysis and reporting skills using Microsoft Excel, Power BI, or similar tools to develop meaningful metrics and dashboards.
• Proficiency with Microsoft 365 collaboration tools and experience administering governance, risk, compliance, audit, knowledge-management, or security-awareness platforms.
• Ability to manage multiple concurrent requests, deadlines, and stakeholders while maintaining attention to detail and accurate records.
• Ability to translate cybersecurity, audit, and compliance requirements into practical activities and clear communications.
• Ability to build cooperative relationships and influence control owners and cross-functional partners without direct authority.
• Ability to handle confidential or sensitive information with discretion and apply sound judgment when escalating risks or delays.
• Ability to identify process gaps, recommend improvements, and follow work through to measurable completion.

Qualifications

• Competent knowledge of cybersecurity governance, risk, compliance, audit, and control concepts.
• Knowledge of audit evidence practices, issue remediation, control testing, records management, policy governance, and document lifecycle management.
• Knowledge of cybersecurity and financial-services frameworks and requirements, such as the National Institute of Standards and Technology Cybersecurity Framework, National Credit Union Administration guidance, Gramm-Leach-Bliley Act, Federal Financial Institutions Examination Council guidance, and Payment Card Industry Data Security Standard.
• Familiarity with security awareness principles, adult learning concepts, phishing simulation practices, and security culture measurement.
• Bachelor’s degree in cybersecurity, information systems, business, risk management, communications, or a related field, or equivalent relevant professional experience.
• 0-2 years of relevant experience in cybersecurity, governance, risk, compliance, IT audit, information security, records management, training coordination, or a related field.
• Experience developing or maintaining business or technical processes, procedures, standards, training content, or program communications.
• Must be bondable.

Preferred Qualifications

• Experience in financial services, fintech, credit unions, or another regulated industry.
• Master’s degree in cybersecurity, information systems, business, risk management, communications, or a related field, or equivalent relevant professional experience.
• Experience supporting Information Security audits, regulatory examinations, control assessments, or issue-remediation programs.
• Experience administering a security awareness training or phishing simulation platform.
• Experience with governance, risk, and compliance platforms; document-management systems; Microsoft SharePoint; Power BI; or similar tooling.
• Relevant certification or progress toward certification, such as Certified in Cybersecurity, Security+, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, or Certified Information Security Manager.

Work Environment

• This position is hybrid, requiring working onsite at UFCU Plaza in Austin, Texas approximately two days per week, with the remaining days worked remotely.
• May occasionally require an adjusted work schedule, overtime, and evening or weekend hours.
• Frequent computer use at a workstation of up to two hours at a time.