Principal IT Risk Management Analyst

Strayer University

Principal IT Risk Management Analyst at Strategic Education driving IT security and risk management strategies. Leading assessments and collaborating across teams to ensure technology risks are effectively managed.

Posted 7/10/2026full-timeRemote • 🇺🇸 United StatesLead💰 $119,300 - $178,900 per yearWebsite

Tech Stack

Tools & technologies

Cyber SecurityServiceNow

About the role

Key responsibilities & impact

Lead and evolve the IT security risk management program in alignment with organizational goals, risk appetite, and risk tolerance
Partner with executive leadership to shape risk strategy and drive enterprise-wide adoption
Serve as a key advisor on risk posture, translating technical findings into strategic business decisions
Identify, assess, and quantify technology risks by evaluating cybersecurity threats, operational vulnerabilities, and emerging technology risks using qualitative and quantitative methodologies
Conduct risk assessments using established frameworks, including NIST CSF and CIS Controls v8
Translate technical findings into clear, actionable business risk and support risk-based decision making
Manage and maintain the enterprise IT risk register, including risk ownership, scoring, and lifecycle tracking
Design and implement IT security risk mitigation strategies and controls aligned with industry standards
Lead the risk exception management process, including evaluation, documentation, and risk acceptance decisions
Provide risk-informed guidance for complex technology initiatives, including emerging areas such as artificial intelligence and machine learning
Integrate IT security risk management practices into business and technology processes
Support the development and lifecycle management of information security policies and standards
Define and evolve risk metrics, key risk indicators (KRIs), and risk appetite thresholds
Develop dashboards and reporting that translate risk data into actionable insights for executive and board-level audiences
Communicate complex risk concepts clearly to both technical and non-technical stakeholders
Drive adoption of IT security risk platforms and workflow automation to improve efficiency and scalability
Identify and implement automation opportunities across risk management workflows
Continuously enhance risk methodologies, tools, and processes
Stay current on the evolving threat landscape, emerging technologies, and industry practices
Mentor and guide junior team members in direct or matrixed reporting relationships
Lead or own workstreams while providing direction and support to junior analysts

Requirements

What you’ll need

5+ years of IT risk management experience, with a focus on risk assessment, quantification, and risk register ownership (not primarily compliance or audit)
3+ years mentoring or leading team members
Demonstrated experience mentoring analysts while owning and delivering discrete risk workstreams or program components
Experience conducting risk assessments aligned to NIST CSF, CIS Controls v8, or similar frameworks
Experience managing an IT risk register, risk exception processes, and residual risk documentation
Experience developing risk metrics, dashboards, and executive reporting
Experience with GRC platforms and workflow automation in a risk context
Experience managing risks related to emerging technologies, including artificial intelligence
Strong leadership, analytical, and problem-solving skills with a risk-first mindset
Demonstrated team leadership through mentoring, coaching, or leading analysts
Strong technical depth to identify risks, evaluate control effectiveness, and translate vulnerability and technical data into business risk
Deep knowledge of NIST CSF, CIS Controls v8, and related frameworks
Proven ability to build and manage an enterprise IT risk register and exception management program
Experience building and evolving risk metrics, KRIs, dashboards, and executive reporting
Hands-on experience with GRC platforms and workflow automation tools (e.g., Archer, ServiceNow GRC, OneTrust, Jira, Rapid7 Nexpose) and the ability to automate processes
Understanding of AI/ML risk domains, including model risk, data integrity, bias, and adversarial threats, with the ability to recommend controls
Experience drafting, reviewing, and improving information security policies and standards
Ability to communicate technical concepts and residual risk clearly to non-technical stakeholders.

Benefits

Comp & perks

medical, dental, vision, life and disability plans
well-being incentives
parental leave
paid time off
certain paid holidays
tax saving accounts (FSA, HSA)
401(k) retirement benefit
Employee Stock Purchase Plan
tuition assistance
entertainment and retail discounts
overtime pay for non-exempt employees

ATS Keywords

✓ Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills & Tools

Risk AssessmentRisk QuantificationRisk Register ManagementRisk Metrics DevelopmentDashboard CreationRisk Exception ManagementAutomation of Risk WorkflowsCybersecurity Threat EvaluationControl Effectiveness EvaluationAI/ML Risk Management

Soft Skills

LeadershipMentoringAnalytical SkillsProblem-SolvingCommunication