Cybersecurity Risk Analyst

About the role

The Cybersecurity Risk Analyst will develop and maintain the information security risk management framework for ASMO’s Technology function. You will work across all departments to identify, assess, treat and monitor information security risks, ensuring compliance with internal policies and regulatory standards.

Key responsibilities

• Design, implement and continuously improve the Information Security Risk Management Framework.
• Identify, assess and treat security risks, maintaining a risk register and key risk indicators (KRIs).
• Monitor remediation plans, track treatment progress and report on risk status.
• Develop, review and update security policies, procedures and standards in line with regulatory requirements.
• Conduct security assessments for new software and infrastructure, ensuring integration of security controls.
• Provide risk‑based security guidance to IT projects and ensure appropriate controls are embedded.
• Audit system activities, perform spot checks, investigate incidents and recommend corrective actions.
• Raise security awareness among end‑users through training sessions and communication.

Required profile

• Bachelor’s degree in Information Technology or a related field.
• Minimum 5 years of experience in information security risk management or a similar role.
• Preferred certification: Certified Data Privacy Solutions Engineer (CDPSE).

Required skills

• Information security risk assessment and management.
• Development and maintenance of KRIs and risk registers.
• Security policy creation and regulatory compliance.
• Conducting security audits and incident analysis.
• Providing risk‑based guidance for IT projects.