Job Title: Cyber Risk Analyst - Senior (Contract to Hire)
Location: Columbus, OH or Merrillville, IN
Work Model: Hybrid — onsite 3 days per week; candidates must be local to the Columbus, OH or Merrillville, IN area
Rate: $46 - $52/hour
Contract Duration: November 16, 2026 – November 15, 2027
Contract-to-Hire: Yes
Employment Type: W-2 Only
Work Authorization: U.S. Citizens Only; no visa sponsorship available

Position Overview

We are seeking an experienced Senior Cyber Risk Analyst to support a mature and evolving Third Party Risk Management (TPRM) and Cyber Assessments program within a large utility environment.

This role will focus on assessing and managing cybersecurity risks associated with third-party suppliers and vendors, supporting vendor control assessments, maintaining third-party risk profiles, tracking issues and exceptions, and helping business and technology stakeholders make informed risk-management decisions.

The Senior Cyber Risk Analyst will work across Cybersecurity, Supply Chain, IT, Operational Technology, Compliance, Internal Audit, Innovation, and business teams to support third-party risk assessments throughout the vendor lifecycle, including onboarding, contract renewal, continuous monitoring, and issue remediation.

A significant component of this role involves supporting and advancing the organization's enterprise Governance, Risk, and Compliance platform, including Archer GRC, as well as supporting control-assessment capabilities such as Fortress.

The ideal candidate brings substantial hands-on experience with TPRM, vendor cyber assessments, SOC 2 reviews, risk reporting, GRC platforms, NIST frameworks, and cross-functional stakeholder management.

Key Responsibilities

Third Party Risk Management

Support execution and continuous improvement of the enterprise Third Party Risk Management program.
Perform and support cybersecurity assessments of suppliers, vendors, service providers, and other third parties.
Assess third-party inherent risk and evaluate applicable cybersecurity controls.
Develop and maintain third-party cyber risk profiles.
Identify, document, and track vendor cybersecurity risks, deficiencies, exceptions, and remediation activities.
Work with business owners and vendor relationship managers to ensure identified risks are understood and appropriately addressed.
Support third-party risk activities associated with:
- Vendor onboarding
- Contract renewals
- Continuous monitoring
- Vendor control assessments
- Risk acceptance
- Exception management
Analyze vendor risk posture and provide actionable information to support management decisions.
Help ensure contracted services meet organizational security and risk-management expectations.

Cyber Assessments

Execute or support Cyber Assessments across business, Cybersecurity, IT, Operational Technology, and Innovation organizations.
Apply established assessment methodologies to determine when assessments are required and how they should be conducted.
Ensure cybersecurity risks identified through assessments are appropriately documented, communicated, mitigated, or formally accepted.
Coordinate assessment activities with internal stakeholders and external service providers.
Ensure assessments meet established objectives, timelines, reporting requirements, and quality expectations.
Support the development and implementation of Cyber Assessment program roadmaps.
Help improve consistency and maturity across Cyber Assessment processes.

Vendor Control Assessments

Perform or support supplier and vendor control assessments.
Review vendor cybersecurity documentation and supporting evidence.
Analyze SOC 2 reports and other security documentation to identify control deficiencies, exceptions, and risk considerations.
Evaluate vendor controls against organizational cybersecurity requirements.
Communicate assessment findings to vendor owners, Supply Chain, Cybersecurity teams, and management.
Track findings through remediation or formal risk disposition.
Support continuous monitoring of third-party cybersecurity posture.

GRC & Archer Support

Support and advance the use of Archer GRC as the system of record for cyber risk, compliance, policy, and assessment activities.
Maintain third-party risk and assessment information within the GRC platform.
Support workflows, reporting, data quality, and process adoption within Archer.
Promote broader utilization and adoption of Archer across relevant business functions.
Serve as an advocate for effective use of Archer capabilities.
Assist with implementation of the Archer roadmap and enhancement initiatives.
Help integrate GRC processes with enterprise systems and data sources.
Support connections and process alignment involving systems such as:
- ServiceNow
- Workday
- Supply Chain systems
- Cybersecurity platforms
Identify opportunities to improve automation, reporting, workflow efficiency, and data consistency within the GRC environment.

Fortress Control Assessments

Support the organization's use of Fortress for third-party and control-assessment activities.
Develop working knowledge of Fortress capabilities and assessment processes.
Support control-assessment execution and reporting.
Contribute to recommendations regarding ongoing use and enhancement of the platform.
Help maximize the business and cybersecurity value obtained from Fortress assessments.
Coordinate assessment results with broader third-party risk-management activities.

Risk Reporting & Analytics

Develop and maintain reports, dashboards, metrics, and analytical summaries related to third-party cybersecurity risk.
Track:
- Vendor risk profiles
- Open findings
- Risk exceptions
- Remediation status
- Assessment completion
- Continuous-monitoring results
Analyze assessment and vendor-risk information to identify trends and emerging risks.
Provide clear information that enables management to make informed vendor-risk decisions.
Translate detailed cybersecurity findings into concise business-focused reporting.
Support leadership reporting and program performance metrics.

Supply Chain & Vendor Lifecycle Integration

Partner closely with Supply Chain teams to embed cybersecurity risk management into vendor processes.
Support cyber-risk assessments during vendor onboarding and contract renewal.
Help ensure vendor cybersecurity considerations are incorporated into supplier-management decisions.
Coordinate with vendor relationship owners regarding identified cybersecurity risks.
Partner with Cyber Vulnerability Management to support comprehensive third-party risk profiles.
Provide cybersecurity risk information to support procurement and contract-management decisions.

Compliance & Audit Support

Collaborate with Cyber Compliance, NERC CIP Compliance, Pipeline Compliance, Internal Audit, and other governance functions.
Support audit and issue-tracking activities related to Cyber Assessments and TPRM.
Assist with remediation tracking and resolution of assessment or audit findings.
Maintain documentation required to demonstrate effective third-party risk-management processes.
Support compliance evidence and reporting requirements.
Help ensure Cyber Assessment processes align with applicable organizational standards and regulatory requirements.

Cross-Functional Collaboration

Work closely with:
- Enterprise Security
- IT
- Operational Technology
- Supply Chain
- Internal Audit
- Cyber Compliance
- NERC CIP Compliance
- Pipeline Compliance
- Innovation teams
- Business stakeholders
- Vendor relationship owners
- External service providers
Educate stakeholders regarding third-party cybersecurity risk and assessment processes.
Clearly communicate risk findings to both technical and non-technical audiences.
Build productive working relationships across multiple business and technology functions.
Support positive business perception of Cyber Assessment services through proactive engagement and responsive support.

Day-to-Day Responsibilities

Perform third-party cyber risk assessments.
Review supplier and vendor security controls.
Analyze SOC 2 reports and supporting cybersecurity documentation.
Determine inherent risk levels for third parties.
Maintain vendor risk profiles.
Track cybersecurity findings, risks, exceptions, and remediation activities.
Enter and maintain assessment data within Archer GRC.
Support Fortress control assessments.
Produce Cyber Assessment reports and dashboards.
Coordinate with business owners and vendor relationship managers.
Support Supply Chain vendor onboarding and contract-renewal processes.
Participate in meetings with Cybersecurity, IT, OT, Supply Chain, and Compliance teams.
Monitor outstanding assessment actions and follow up with stakeholders.
Analyze third-party risk data and identify trends.
Support process-improvement initiatives across the Cyber Assessments program.
Assist with audit and compliance requests.
Help advance adoption and effectiveness of GRC tools and processes.

Required Qualifications

Bachelor's degree or equivalent combination of education and relevant professional experience.
6+ years of Third Party Risk Management experience across relevant support functions.
6+ years of experience with vendor control assessments, SOC 2 reports, risk reporting, and metrics.
Strong working knowledge of TPRM processes, methodologies, reporting, and metrics.
Experience assessing vendor cybersecurity posture and identifying third-party risks.
Experience managing cybersecurity findings, risk exceptions, and remediation activities.
Solid understanding of cybersecurity risk-management principles and industry best practices.
Strong understanding of the NIST Cybersecurity Framework and related cybersecurity-control concepts.
Experience working with GRC processes and risk-management platforms.
Strong analytical and problem-solving capabilities.
Experience with process analysis, process development, and root-cause analysis.
Strong Microsoft Office 365 skills.
Ability to quickly learn new technologies, systems, and cybersecurity concepts.
Strong collaboration, negotiation, communication, organizational, and conflict-resolution skills.
Demonstrated experience contributing to process-improvement initiatives.
Strong written and verbal communication skills.
Demonstrated experience successfully supporting or delivering TPRM projects.
Ability to work independently across multiple functional domains with limited assistance.
Ability to communicate effectively with technical and non-technical stakeholders.
Must be a U.S. Citizen.
Must be local to the Columbus, OH or Merrillville, IN area and able to work onsite three days per week.

Preferred Qualifications

Experience using Archer GRC / RSA Archer.
Experience with Fortress or similar third-party cybersecurity assessment platforms.
Experience with Microsoft Excel and Word.
Experience with SharePoint.
Experience developing reports, dashboards, and analytics.
Experience with ServiceNow.
Experience supporting integrations between GRC platforms and enterprise systems.
Knowledge of electric and gas utility operations.
Previous experience within the utility, energy, or critical-infrastructure sector.
Familiarity with NERC CIP, Pipeline Compliance, or other regulated cybersecurity environments.
Experience supporting Supply Chain, procurement, or vendor-management processes.
Experience with continuous third-party risk monitoring.

Core Competencies

Third Party Risk Management
TPRM
Cyber Risk
Cyber Assessments
Vendor Risk Management
Vendor Control Assessments
SOC 2
Archer GRC
RSA Archer
Fortress
Governance, Risk & Compliance
NIST Cybersecurity Framework
Risk Assessments
Risk Profiles
Risk Exceptions
Remediation Tracking
Continuous Monitoring
Cybersecurity Compliance
Supply Chain Risk
Vendor Management
Reporting & Analytics
Cybersecurity Metrics
Process Improvement
Stakeholder Management
Audit Support
ServiceNow

Ideal Candidate Profile

The ideal candidate is an experienced Third Party Risk Management professional who can independently evaluate supplier and vendor cybersecurity risks while working effectively across Cybersecurity, IT, OT, Supply Chain, Compliance, Audit, and business organizations.

The strongest candidate will have substantial hands-on experience conducting vendor control assessments, reviewing SOC 2 reports, maintaining third-party risk profiles, managing findings and exceptions, and producing meaningful risk reporting and metrics.

They should also be comfortable operating within an enterprise GRC environment, ideally Archer, and understand how third-party cybersecurity risk fits into vendor onboarding, contract renewal, continuous monitoring, and broader supply chain risk-management processes.

Success in this role requires someone who can combine technical cybersecurity knowledge with strong business communication, analytical judgment, and the ability to turn complex assessment results into clear and actionable risk information.

Senior Cyber Risk Analyst (Contract to Hire)