Information Security Risk Analyst

The Information Security Risk Analyst is responsible for identifying, assessing, tracking, and communicating information security risks across the organization. This role supports a maturing cybersecurity program by managing acceptable enterprise and third-party risks and leading security training initiatives. 

At CivicPlus, we strive to bring our company vision to life through innovation and collaboration. Supported by approachable leadership and transparent communication, we're empowered to make an impact on local government and the residents they serve. Grow your career alongside great people, where authenticity is welcome, successes are celebrated, and potential is nurtured.

As an InfoSec Risk Analyst, you will:

• →Identify and translate inherent and residual risk through likelihood, impact, treatment plans, and ownership.  
• →Define and track risk and awareness key metrics to measure program effectiveness and communicate to leadership and governance committees. 
• →Conduct and manage enterprise information security risk assessment through recognized frameworks (including NIST 800-30) and maintain an information security risk register.  
• →Lead third-party security risk assessments for vendors, partners, and service providers through analysis of assurance documentation, security testing summaries, and security questionnaires. 
• →Maintain the information security risk register and third-party vendor risk inventory to track and monitor ongoing risks and approved exceptions. 
• →Develop and lead enterprise security awareness training, including phishing simulations and targeted role-based training for security education and reporting. 
• →Support internal and external security and compliance assessments through risk evidence and documentation. 
• →Partner closely with organizational functions and key stakeholders to understand and address organizational risks across systems and processes, and ensure security risks are understood, prioritized, and treated in alignment with organizational risk appetite. 

We know that excellent candidates come from diverse backgrounds. Even if you don’t meet 100% of the listed requirements, we encourage you to apply!

This role offers:

• Shape how security risk is managed across CivicPlus. Identify, assess, and guide the treatment of enterprise and third-party risks that impact our platforms and customers.
• Turn complex security risk into clear business insight. Partner with leaders across the organization to translate technical risk into actionable decisions.
• Build a stronger security culture. Lead enterprise security awareness initiatives, including phishing simulations and role-based training that help employees stay ahead of threats.
• Contribute to a growing cybersecurity program. Help mature risk management practices, frameworks, and reporting that strengthen CivicPlus’ overall security posture.

• Introductory call with Talent Acquisition
• Interview with the Hiring Manager
• Interviews with Team Leadership (may include multiple conversations)
• Offer

Note: The process may vary slightly depending on the role. 

•  CivicPlus is currently unable to provide visa sponsorship for this position now or in the future. Applicants must be authorized to work in the US. 
• We encourage you to apply as soon as possible, as applications will be reviewed on a rolling basis, and the posting may close earlier at the discretion of the Talent Acquisition team

CivicPlus is proud to be an Equal Employment Opportunity employer. We celebrate and support diversity for the benefit of our employees, products, clients, and communities. Reasonable accommodations are available during the interview process.