Senior Cyber Risk & Compliance Analyst

Senior Cyber Risk & Compliance Analyst    Location: Bradenton or Palm Beach Gardens, FL Base Salary Rate: $117,887.00 - $138,690.00 Job type: Full-time (DM)   About This Role The Senior Cyber Risk & Compliance Analyst strengthens KGS cybersecurity governance, enterprise risk management, compliance, audit readiness, and security assurance. This senior individual contributor combines governance expertise with practical technical experience across infrastructure, applications, identity, cloud services, and business processes. The role translates technical issues into defensible risk decisions, measurable remediation plans, compliance controls, and clear executive reporting. The position supports KGS priorities including Drata operationalization, ISO/IEC 27001 and TISAX readiness, NIST Cybersecurity Framework alignment, SOX IT General Controls, cybersecurity policy and standards, penetration testing and vulnerability remediation, third-party risk, identity governance, operational resilience, and continuous improvement. Key Responsibilities Governance, Risk and Executive Reporting Lead cybersecurity risk assessments and maintain risk registers, treatment plans, exceptions, risk acceptances, corrective actions, and closure evidence. Translate vulnerabilities, audit findings, control deficiencies, and regulatory requirements into business impact, residual risk, and prioritized action plans. Develop key risk indicators, dashboards, governance materials, and concise reporting for cybersecurity leadership and executive stakeholders. Facilitate risk and control reviews with application, infrastructure, business, compliance, and control owners. GRC Platform and Framework Readiness Administer and mature Drata or a comparable governance, risk, and compliance platform, including controls, frameworks, evidence, tests, policies, owners, integrations, and workflows. Lead or support readiness and gap assessments for frameworks (e.g., ISO/IEC 27001, TISAX, NIST CSF, and SOX IT General Controls, etc.). Map requirements across frameworks to reduce duplicate effort and establish practical remediation roadmaps. Troubleshoot evidence and integration issues involving cloud, identity, human resources, security, and enterprise application platforms. Audit, Controls and Policy Coordinate internal and external IT and cybersecurity audits, validate evidence quality, monitor requests, and drive findings through remediation and closure. Evaluate logical access, privileged access, provisioning and deprovisioning, segregation of duties, change management, computer operations, logging, monitoring, backup, and recovery controls. Develop and maintain cybersecurity policies, standards, procedures, control requirements, and framework mappings. Assess control design and operating effectiveness and recommend sustainable corrective actions. Technical Assurance and Remediation Coordinate application, infrastructure, network, and other penetration testing activities and maintain centralized remediation tracking. Validate severity, business impact, ownership, compensating controls, false-positive determinations, residual risk, and retest requirements. Partner with infrastructure, application, cloud, engineering, identity, and vendor teams to drive critical and high-risk findings to verified closure. Provide risk and compliance guidance for Windows and Linux environments, Active Directory and Microsoft Entra ID, ERP platforms, cloud services, networks, logging, monitoring, patching, and system hardening. Third-Party Risk and Operational Resilience Perform cybersecurity reviews of technology providers using questionnaires, certifications, SOC reports, penetration testing, contract requirements, and remediation evidence. Evaluate shared responsibility models and establish clear security obligations for SaaS, cloud, managed-service, and other technology providers. Support governance of business continuity, disaster recovery, business impact assessments, recovery objectives, resilience testing, and critical-application inventories. Support incident response governance, post-incident corrective actions, and assessment of systemic control issues. Cross-Functional Leadership Lead working sessions and governance forums across Cybersecurity, Digital Technology, Finance, Human Resources, Legal, Privacy, Procurement, Internal Audit, and business teams. Communicate complex technical and regulatory matters in plain language appropriate for engineers, control owners, auditors, and executives. Challenge assumptions respectfully, surface material risk early, and drive assigned issues to measurable closure.    Basic Qualifications   Bachelor’s Degree 8+ years of progressive experience across IT, cybersecurity, audit, risk, or compliance, including meaningful hands-on technical responsibility. 2+ years of experience with ISO/IEC 27001 and NIST-based cybersecurity frameworks. 2+ years’ demonstrating progression from technical IT or security work into cybersecurity governance, risk, compliance, audit, or security leadership. 2+ years of experience conducting or supporting internal and external IT or cybersecurity audits and evaluating control design and operating effectiveness, including experience auditing against SOX ITGC. 2+ years’ experience managing vulnerability or penetration-testing findings through remediation, validation, and closure. 2+ years of experience working with identity and access management, Windows and Linux infrastructure, network security, enterprise applications, cloud services, logging and monitoring, system hardening, and incident response. 2+ years of experience developing policies, standards, procedures, risk records, audit evidence, and executive-level reporting. 2+ years of experience leading complex cross-functional initiatives independently and communicating risk clearly to technical and nontechnical audiences.   Preferred Qualifications    Master’s degree in cybersecurity, information technology, computer science, technical management, management information systems, or a related field. GRC Platform Administration: Hands-on experience implementing, administering, configuring, or materially improving Drata or a comparable enterprise governance, risk, and compliance platform, including controls, evidence, testing, ownership, workflows, or integrations. SOX IT General Controls: Practical experience designing, operating, testing, auditing, or remediating SOX IT General Controls, including logical access, privileged access, user lifecycle management, segregation of duties, change management, computer operations, or related controls. Enterprise Application & ERP Security: Experience assessing or administering security for SAP, SAP Identity and Access Management, Oracle, or another major enterprise ERP or business-critical application environment. Critical Infrastructure or Operational Technology Security: Cybersecurity experience involving critical infrastructure, operational technology, industrial control systems, SCADA, manufacturing technology, or comparable operational environments. Business Continuity & Operational Resilience: Experience supporting or governing business continuity, disaster recovery, business impact analysis, recovery objectives, resilience testing, ISO 22301, or comparable operational-resilience practices. Large/Complex Enterprise Experience: Cybersecurity, risk, compliance, audit, or IT experience within a large, geographically distributed, manufacturing, regulated, multi-entity, or comparably complex enterprise environment.