Note: The job is a remote job and is open to candidates in USA. Xerox is a workplace technology and services company seeking a Senior Risk Analyst to support and lead cybersecurity risk initiatives within its Governance, Risk, and Compliance organization. The role focuses on cybersecurity and third-party risk assessments, CMMC and FedRAMP compliance, security policy exceptions, risk register management, audits, and executive-level reporting.
Responsibilities
- Lead and support cybersecurity risk assessments using frameworks such as CIS Critical Security Controls and the NIST Cybersecurity Framework
- Support and mature Xerox’s Third-Party Risk Management program, including vendor security questionnaires, third-party risk assessments, ongoing monitoring, and escalation of high-risk findings
- Review vendor-submitted evidence, including SOC 2 reports, security questionnaires, certifications, and due diligence materials
- Support CMMC compliance efforts, including control documentation, System Security Plan development, readiness assessments, and leadership reporting
- Advise on FedRAMP authorization and continuous monitoring activities for applicable cloud services
- Manage the security policy exception process, including intake, risk scoring, compensating control review, and leadership approval preparation
- Provide direction, guidance, and quality review for risk analysts and related GRC workstreams
- Partner with Security Governance, Security Architecture, Global Sourcing, Internal Audit, and business leaders on risk-related matters
- Maintain the security risk register, ensuring risks are documented, prioritized, tracked, and driven toward closure
- Develop dashboards, metrics, and reports that translate technical risk findings into clear business risk narratives
- Support internal and external audits, including ISO 27001, SOC 2, and customer security assessments
- Track changes in cybersecurity regulations, frameworks, and compliance requirements, including NIST, CMMC, and FedRAMP updates
- Help establish and maintain risk assessment methodologies, templates, standards, and scalable processes
- Support GRC tooling and identify opportunities to improve efficiency, consistency, and program coverage
Skills
- Bachelor's degree in Cybersecurity, Information Systems, Computer Science, or a related field; equivalent practical experience will also be considered
- 5+ years of experience in information security, IT risk management, audit, compliance, or a related field
- Experience leading, mentoring, or providing guidance to analysts or project teams
- Strong working knowledge of CIS Critical Security Controls and the NIST Cybersecurity Framework
- Experience with third-party/vendor risk management programs, including questionnaires, due diligence, and ongoing monitoring
- Working knowledge of CMMC requirements and NIST SP 800-171
- Working knowledge of FedRAMP requirements and authorization processes, including SSPs, SARs, and POA&Ms
- Experience with security policy exception processes, risk-based decision-making, and compensating controls
- Strong communication and presentation skills, with the ability to explain technical risk findings to senior leadership and business stakeholders
- Relevant certification such as CISSP, CRISC, CRMA, CISA, CCSK, or a CMMC-related credential
- Direct experience supporting or leading a CMMC or FedRAMP assessment or authorization effort
- Experience with SOC 2, ISO 27001, or similar audit frameworks
- Experience with GRC or risk management tools such as ServiceNow GRC, OneTrust, or similar platforms
Benefits
- Remote work from the United States, Eastern or Central Time Zone
Company Overview
Company H1B Sponsorship