The Security Risk Analyst supports the organization’s Information Security Risk Management program by executing many cyber risk functions such as regulatory compliance, 3rd Party, and security awareness activities under the direction of security leadership. This role focuses on ensuring adherence to regulatory requirements, industry standards, and internal policies through collaboration with compliance, legal, and technology teams.
The analyst applies strong analytical skills, attention to detail, and effective communication to perform risk assessments, maintain security policies, and assist with compliance initiatives. They help track program performance, prepare reports for leadership, and contribute recommendations for improvement. Additionally, the analyst promotes a collaborative environment by sharing insights and supporting organizational security objectives.
Key Responsibilities:
Perform and mature enterprise risk assessments using frameworks such as NIST CSF, NIST 800-53, SOC 2, and CIS, including documenting findings and driving mitigation strategies across systems, processes, and infrastructure.
Demonstrated technical acumen in analyzing vulnerability assessment reports to support troubleshooting, remediation, and risk reduction initiatives.
Develop and execute security awareness programs, including training, phishing simulations, newsletters, and communications to drive behavioral change and risk reduction.
Deliver actionable reporting and insights, including assessment results, GRC metrics, dashboards, and executive-level presentations summarizing risk posture, control effectiveness, and program maturity.
Perform end-to-end cyber third-party risk assessments, including vendor risk assessments, onboarding/offboarding processes, and embedding a shift-left security approach across the vendor lifecycle—particularly for high-risk and complex engagements.
Drive process and tooling optimization, contributing to GRC platform design, standardizing workflows, and improving operational consistency and scalability.
Support governance and control management, including developing and maintaining policies, standards, and control libraries aligned to regulatory requirements and industry best practices.
Enable audit readiness and due diligence, managing evidence collection, standardizing responses, and maintaining repositories for external audits and third-party inquiries.
Stay current on evolving regulations, frameworks, and industry trends, incorporating updates into practices and controls.
Manage priorities and execution using Agile methodologies, including tracking tasks, resolving issues, escalating risks, and providing timely status updates.
Required Skills & Expertise:
Bachelor’s degree in Cybersecurity, Information Systems, or related field. 1–3 years of experience in GRC, risk management, or compliance within cybersecurity.
Working knowledge of regulatory frameworks, audit processes, and control environments, including familiarity with industry standards and risk management terminology.
Understanding of third-party/vendor risk management (TPRM) processes and enterprise risk concepts, with the ability to support risk identification, assessment, and mitigation activities.
General knowledge of security tools and controls across domains such as network security, endpoint protection, email security, vulnerability management, access controls, and log management; foundational understanding of cloud service models (IaaS, SaaS, PaaS).
Proven ability to track, measure, and report on IS GRC program effectiveness using tools such as ServiceNow, Archer, SharePoint, and Power BI; able to translate metrics into actionable insights for leadership.
Experience contributing to continuous improvement of GRC programs, including identifying enhancements and presenting recommendations to leadership.
Experience developing and delivering training materials, with strong written and verbal communication skills to effectively engage technical and business stakeholders.
Strong organizational, analytical, and multitasking abilities, with a demonstrated ability to manage competing priorities and collaborate effectively across teams.
Preferred Qualifications:
Strong consideration for experience with cloud security compliance (Azure/AWS).
Experience with Microsoft Office Suite; familiarity with tools such as SharePoint, Power BI, ServiceNow, UpGuard, or Archer.
Achieved certifications such as: CISA, CRISC, GSEC/GISP, CISSP, CISM, CCSP, CIDSP, Security+
Skills Required
- Bachelor's degree in Cybersecurity, Information Systems, or related field
- 1-3 years experience in GRC, risk management, or compliance within cybersecurity
- Perform enterprise risk assessments using NIST CSF, NIST SP 800-53, SOC 2, and CIS
- Analyze vulnerability assessment reports to support troubleshooting, remediation, and risk reduction
- Develop and execute security awareness programs including training and phishing simulations
- Perform end-to-end third-party/vendor risk assessments and manage vendor onboarding/offboarding
- Support governance and control management; develop and maintain policies, standards, and control libraries
- Enable audit readiness and manage evidence collection and responses for external audits
- Proven ability to track, measure, and report GRC program effectiveness using ServiceNow, Archer, SharePoint, and Power BI
- General knowledge of security tools and controls: network security, endpoint protection, email security, vulnerability management, access controls, and log management; foundational cloud model understanding (IaaS, SaaS, PaaS)
- Experience developing training materials and strong written and verbal communication skills
- Strong organizational, analytical, and multitasking abilities; ability to manage competing priorities
- Experience contributing to continuous improvement of GRC programs and presenting recommendations to leadership
- Experience with cloud security compliance (Azure/AWS)
- Familiarity with Microsoft Office Suite and tools such as SharePoint, Power BI, ServiceNow, UpGuard, or Archer
- Professional certifications (e.g., CISA, CRISC, GSEC/GISP, CISSP, CISM, CCSP, CIDSP, Security+)
Protective Life Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Protective Life and has not been reviewed or approved by Protective Life.
-
Retirement Support — A pension plan alongside a 401(k) with employer match is repeatedly highlighted and considered a standout feature. Feedback suggests these offerings provide strong long‑term financial security.
-
Healthcare Strength — Medical, dental, vision, and prescription coverage are complemented by HSA/FSA options with company contributions and wellness incentives. Feedback suggests the breadth of health benefits is comprehensive.
-
Leave & Time Off Breadth — Paid time off and holidays are frequently cited as positives, with parental leave and adoption assistance available. Feedback suggests time‑off policies support work‑life balance.
Protective Life Insights
What We Do
Protective Life Corporation (Protective) provides financial services through the production, distribution and administration of insurance and investment products throughout the United States. Protective traces its roots to its flagship company founded in 1907, Protective Life Insurance Company. Throughout its more than 110-year history, Protective’s growth and success can be largely attributed to its ongoing commitment to serving people and doing the right thing — for its employees, distributors and, most importantly, its customers. Protective’s home office is located in Birmingham, Alabama, and its 3,000+ employees work across the United States. As of June 30, 2020, Protective had assets of approximately $123 billion. Protective Life Corporation is a wholly owned subsidiary of Dai-ichi Life Holdings,
