Note: The job is a remote job and is open to candidates in USA. Symetra is a national financial services company dedicated to helping people achieve their financial goals and feel confident about the future. The Senior IT Risk and Security Analyst will serve as a key interface among IT, Audit Services, and business teams, leading IT risk management, third-party risk, audit and compliance programs, control assessments, remediation, and executive reporting.
Responsibilities
- Serve as a trusted advisor to IT and business teams by identifying technology, security, and operational risks, recommending effective controls, and ensuring risks are properly assessed, documented, and mitigated
- ·Lead enterprise IT risk management activities, including annual risk assessments, risk committee facilitation, risk reporting, policy development, risk register management, and continuous improvement of the organization's risk management framework
- Support third-party technology risk management across the vendor lifecycle, including risk tiering, pre-contract due diligence, security assessments, and periodic monitoring. Evaluate SOC reports, ISO 27001 certifications, security questionnaires, penetration tests, external security ratings, encryption and data-handling practices, AI usage, contractual controls, and business continuity capabilities; document risk ratings and findings, drive remediation, and escalate unresolved risks in partnership with Procurement, Legal, business owners, and security teams
- Manage and enhance IT audit and compliance programs, including SOX IT General Controls (ITGCs), ISO 27001 security controls, regulatory requirements, and internal/external audit activities to ensure controls are designed and operating effectively
- Partner with control owners, auditors, and business stakeholders to track audit findings, drive remediation efforts, provide training, and ensure sustainable compliance across technology and business functions
- Evaluate third-party vendors, emerging technologies, and business initiatives to identify security and operational risks, implement monitoring controls, and support disaster recovery and business continuity planning efforts
- Develop executive-level reporting and dashboards that communicate risk exposure, audit results, compliance status, and remediation progress to senior leadership and governance committees
- Conduct reviews of information systems, business applications, infrastructure, and operational processes to assess security posture, control effectiveness, and alignment with company objectives
- Maintain ownership of risk management tools and processes, ensuring accurate documentation, reporting, workflow management, and ongoing program maturity
Skills
- You're an analytical problem solver with a strong understanding of information security, IT risk management, audit methodologies, compliance frameworks, and internal controls
- You have experience managing complex risk assessments, audit programs, and compliance initiatives, with the ability to translate technical risks into business-focused recommendations
- You're an effective communicator who can confidently collaborate with executives, auditors, IT leaders, business stakeholders, and external vendors to influence positive outcomes
- You thrive working independently while also serving as a trusted advisor, mentor, and subject matter expert for colleagues and cross-functional teams
- You possess strong organizational skills and attention to detail, enabling you to manage multiple priorities, maintain accurate documentation, and deliver high-quality results in a fast-paced environment
- Employer work visa sponsorship and support are not provided for this role
- Applicants must be currently authorized to work in the United States at hire and must maintain authorization to work in the United States throughout their employment with our company
- Bachelor's degree in information systems, Cybersecurity, Computer Science, Accounting, Business, or related field, or equivalent combination of education and experience
- 5-8 years of experience in IT risk management, information security, IT audit, cybersecurity governance, compliance, or related disciplines
- Professional certifications such as CISA, CISSP, CRISC, CISM, CIA, ISO 27001 Lead Implementer/Auditor, or other relevant credentials
- Experience with SOX ITGCs, ISO 27001, IT risk assessment methodologies, vendor risk management, security governance, and audit lifecycle management
- Demonstrated ability to influence stakeholders, lead initiatives, and communicate complex technical concepts to both technical and non-technical audiences
Benefits
- Flexible full-time or hybrid telecommuting arrangements
- 401(k) plan with immediate vesting and company matching up to 6%
- Paid time away including vacation and sick time, flex days and ten paid holidays
- Company matching to double employees' charitable contributions
Company Overview