Security resources are finite, and leaders need a defensible, consistent way to decide which risks to mitigate, which to transfer through insurance or contracts, which to accept, and which to avoid. The risk analyst supplies that basis. Working a layer above the technical controls within the governance, risk, and compliance function, the analyst identifies threats and vulnerabilities, estimates their potential impact on the business, and translates that analysis into terms executives and risk owners can act on.
Responsibilities#
- Conduct risk assessments of systems, vendors, projects, and processes, guided by a framework such as the NIST Risk Management Framework, ISO 27005, or FAIR for quantitative analysis.
- Maintain the risk register: the living catalog of known risks with their likelihood, impact, treatment plans, and owners.
- Interview system owners, review control evidence, and score findings against the organization's risk appetite.
- Track remediation to closure and prepare reports and heat maps for governance committees.
- Support third-party and supply chain risk reviews, and help quantify exposure during audits, incidents, or major changes such as a cloud migration or acquisition.
Skills and background#
- Analytical rigor: comfort with frameworks and standards and the ability to reason about probability and impact, with quantitative methods increasingly valued for putting dollar figures on exposure.
- Technical literacy: enough understanding of how controls work and where they fail to judge a finding soundly.
- Business framing: the context to express risk in terms of revenue, operations, and reputation rather than raw vulnerability counts.
- Facilitation and diplomacy: the skill to challenge assumptions and press busy stakeholders for honest answers without becoming adversarial.
Getting into the role#
People enter from several directions. Some arrive from technical security or IT operations and move upward to focus on business impact; others come from audit, compliance, or general business analysis and deepen their security knowledge over time. Early in the role, an analyst handles individual assessments and register upkeep under supervision. Common credentials include CRISC, CISA, and the broader CISSP, though demonstrated judgment often matters more than any single certificate.
Career progression#
With experience, analysts take on higher-stakes evaluations, mentor junior staff, and may specialize in areas such as third-party risk, operational technology, or quantitative modeling. Growth paths lead toward senior or lead risk analyst, risk manager, and ultimately roles like director of risk or a seat supporting the chief information security officer.
Related roles#
- Compliance Analyst: focuses on meeting specific regulatory and contractual obligations rather than the broader question of exposure.
- Security Auditor: independently tests whether controls operate as intended.
- Policy Analyst: defines the rules the organization expects itself to follow.
- GRC Program Manager: coordinates the people, tooling, and cadence that keep these functions running.