Senior Cyber Risk & Compliance Analyst
Location: Bradenton or Palm Beach Gardens, FL
Base Salary Rate: $117,887.00 - $138,690.00
Job type: Full-time (DM)
About This Role
The Senior Cyber Risk & Compliance Analyst strengthens KGS cybersecurity governance, enterprise risk management, compliance, audit readiness, and security assurance. This senior individual contributor combines governance expertise with practical technical experience across infrastructure, applications, identity, cloud services, and business processes. The role translates technical issues into defensible risk decisions, measurable remediation plans, compliance controls, and clear executive reporting.
The position supports KGS priorities including Drata operationalization, ISO/IEC 27001 and TISAX readiness, NIST Cybersecurity Framework alignment, SOX IT General Controls, cybersecurity policy and standards, penetration testing and vulnerability remediation, third-party risk, identity governance, operational resilience, and continuous improvement.
Key Responsibilities
Governance, Risk and Executive Reporting
Lead cybersecurity risk assessments and maintain risk registers, treatment plans, exceptions, risk acceptances, corrective actions, and closure evidence.
Translate vulnerabilities, audit findings, control deficiencies, and regulatory requirements into business impact, residual risk, and prioritized action plans.
Develop key risk indicators, dashboards, governance materials, and concise reporting for cybersecurity leadership and executive stakeholders.
Facilitate risk and control reviews with application, infrastructure, business, compliance, and control owners.
GRC Platform and Framework Readiness
Administer and mature Drata or a comparable governance, risk, and compliance platform, including controls, frameworks, evidence, tests, policies, owners, integrations, and workflows.
Lead or support readiness and gap assessments for frameworks (e.g., ISO/IEC 27001, TISAX, NIST CSF, and SOX IT General Controls, etc.).
Map requirements across frameworks to reduce duplicate effort and establish practical remediation roadmaps.
Troubleshoot evidence and integration issues involving cloud, identity, human resources, security, and enterprise application platforms.
Audit, Controls and Policy
Coordinate internal and external IT and cybersecurity audits, validate evidence quality, monitor requests, and drive findings through remediation and closure.
Evaluate logical access, privileged access, provisioning and deprovisioning, segregation of duties, change management, computer operations, logging, monitoring, backup, and recovery controls.
Develop and maintain cybersecurity policies, standards, procedures, control requirements, and framework mappings.
Assess control design and operating effectiveness and recommend sustainable corrective actions.
Technical Assurance and Remediation
Coordinate application, infrastructure, network, and other penetration testing activities and maintain centralized remediation tracking.
Validate severity, business impact, ownership, compensating controls, false-positive determinations, residual risk, and retest requirements.
Partner with infrastructure, application, cloud, engineering, identity, and vendor teams to drive critical and high-risk findings to verified closure.
Provide risk and compliance guidance for Windows and Linux environments, Active Directory and Microsoft Entra ID, ERP platforms, cloud services, networks, logging, monitoring, patching, and system hardening.
Third-Party Risk and Operational Resilience
Perform cybersecurity reviews of technology providers using questionnaires, certifications, SOC reports, penetration testing, contract requirements, and remediation evidence.
Evaluate shared responsibility models and establish clear security obligations for SaaS, cloud, managed-service, and other technology providers.
Support governance of business continuity, disaster recovery, business impact assessments, recovery objectives,…