Sr. GRC Risk Analyst

Description

WHO WE ARE

Come join the company at the center of how the world adopts AI securely. Cyera’s mission is to give enterprises the confidence to embrace AI safely — deciding exactly what it can see and do as it reaches deeper into the business. We started by solving the hardest problem in data security: finding and securing data faster and more precisely than anyone thought possible. That foundation is now the essential AI trust infrastructure for the Fortune 1000. We’re hiring mission-driven talent to put those leaders at the center of our story.

THE OPPORTUNITY

We are hiring a Senior GRC Analyst- Risk to build and run Cyera's enterprise risk register. You will design the risk management framework, own the full risk lifecycle from identification to closure, and turn risk data into clear decisions for leadership. This is a builder role: you will set the foundation, then operate it at scale as Cyera grows.

You will report to the GRC Manager and work closely with Security, Engineering, IT, Legal, Privacy, Finance, and business leaders.

RESPONSIBILITIES:

Build the framework

Design and document Cyera's enterprise risk management methodology, including risk taxonomy, scoring model (likelihood and impact), risk appetite and tolerance thresholds, and treatment options

Align the program to recognized frameworks such as ISO 27001, NIST CSF and NIST 800-30, SOC 2, and ISO 42001 for AI risk

Establish risk ownership, RACI, escalation paths, and governance cadence with the GRC Manager and leadership

Standardize risk register structure, naming conventions, and ID nomenclature so risks are consistent and audit-ready

Operate the risk register

Own the enterprise risk register end to end: identification, assessment, treatment, monitoring, acceptance, and closure

Run recurring risk assessments and workshops with control owners and business stakeholders

Track treatment plans, remediation due dates, and risk acceptances, and follow up with owners to keep work moving

Map risks to controls, policies, audit findings, vendor risks, and incidents so the register reflects the full picture

Maintain evidence and documentation that supports internal and external audits

Report and influence

Produce risk reporting and dashboards for the GRC Manager, CISO, and governance committees, including top risks, trends, and KRIs

Translate technical and operational risk into clear business language for executives

Prepare risk inputs for audits, customer security reviews, and board or leadership updates

Improve and scale

Automate intake, scoring, and reporting through GRC tooling and simple workflows (Jira, GRC platforms, spreadsheets) before adding complexity

Integrate risk management with TPRM, vulnerability management, incident response, AI governance, and change management

Train risk owners and build reusable templates, guides, and playbooks

Requirements

REQUIRED QUALIFICATIONS:

3 to 5 years of experience in GRC, IT risk, information security risk, or enterprise risk management

Hands-on experience building or significantly maturing a risk register and risk assessment process, not just maintaining one

Working knowledge of at least two of ISO 27001, NIST CSF, NIST 800-30, NIST 800-53, or SOC 2

Strong grasp of risk scoring, risk appetite, treatment, and acceptance, and the judgment to apply them practically

Experience mapping risks to controls and supporting external audits

Ability to run risk conversations with engineers and executives, and to hold owners accountable without slowing the business

Clear, concise writing and reporting skills

Comfort working in a fast-moving SaaS or cloud environment with changing priorities

Bachelor's degree in a related field, or equivalent experience

Nice to have

Certifications such as CRISC, CISA, CISSP, ISO 27001 Lead Implementer or Lead Auditor, or ISO 31000 Risk Manager

Experience with GRC platforms (for example Anecdotes, Drata, Vanta, ServiceNow IRM, or Archer) and Jira workflows

Exposure to AI risk management, ISO 42001, or the EU AI Act

Familiarity with multi-framework environments such as PCI DSS, FedRAMP, C5, or ENS

Experience at a security or data security vendor

Data Privacy and Protection experience

COMPENSATION INFORMATION:

Compensation Range: $100,000 - $120,000.

The range represents total compensation, and may include incentive for sales roles, equity or benefits, as applicable.

This compensation range represents Cyera’s good faith and reasonable estimate of the range of possible compensation for this role at the time of posting, and Cyera may ultimately pay more or less than the posted range. The final salary for this position will be determined in Cyera’s sole discretion, consistent with applicable law, and based on a variety of factors, including but not limited to the employee’s work experience, skills, and qualifications for the role, as well as the needs of Cyera’s business and other operational considerations.

Final compensation will vary based on seniority and relevance of experience, location, and position requirements.

This role may be eligible for potential merit increases based on factors such as individual or company performance, time in role, and other discretionary factors. In addition to a standard benefits and equity package, we offer a generous salary. Final compensation will vary based on seniority and relevance of experience, location, and position requirements.

This role may be eligible for potential merit increases based on factors such as individual or company performance, time in role, and other discretionary factors.​

BENEFITS - Why Cyera?

Ability to work remotely, with office setup reimbursement

Unlimited PTO

Paid holidays and sick time

Health, vision, and dental insurance

Life, short and long-term disability insurance

Originally posted on Himalayas