Supports the Information Security Officer with cybersecurity risk assessments, control monitoring, access reviews, vulnerability and patch tracking, policy documentation, issue management, security awareness activities, and management reporting. The role evaluates IT controls, compares practices against CIS and FFIEC frameworks, documents risks and exceptions, and follows up on remediation actions in a regulated banking environment.
Department: Enterprise Risk Management Date: October 2026
Reports To: 1st Vice President, Information Security Officer
OVERVIEW:
The Information Security Risk Analyst supports the Information Security Officer (ISO) in carrying out the Bank’s information security risk oversight activities. This position assists with information security risk assessments, control monitoring, access reviews, issue tracking, program documentation, and reporting. Working under the direction of the ISO, this role gathers and organizes information, documents observations, follows up on assigned actions, and escalates unusual, urgent, or time-sensitive matters. This position is intended for an early-career professional developing knowledge of information security risk management in a regulated financial institution.
PRIMARY ACCOUNTABILITIES / RESPONSIBILITIES:
- Assist with maintaining information security policies, standards, procedures, control inventories, and supporting program documentation.
- Help compare information security policies, controls, and processes against the Center for Internet Security (CIS) control framework, Federal Financial Institutions Examination Council (FFIEC) Interagency Guidelines and industry best practices.
- Support risk assessments across systems, applications, and material changes by gathering information, performing analysis, and by documenting relevant risks and controls.
- Assist with the evaluation of key security controls to determine the extent to which the controls are implemented correctly, operate as intended, and sufficiently mitigate identified risks.
- Assist in the second line of defense evaluation and monitoring of Information Technology’s internal controls, reporting, processes and procedures.
- Support periodic user access reviews by preparing access lists, comparing access with provided role information, documenting exceptions, and tracking review completion.
- Assist with monitoring vulnerabilities, configuration changes, system updates, and patch remediation against Bank policies and established timeframes.
- Support security awareness activities by helping maintain materials, schedules, communications, and training completion records.
- Assist with preparing supporting materials and status information for management reporting.
OTHER ACCOUNTABILITIES / RESPONSIBILITIES:
- Performs other duties as assigned by Management.
POSITION REQUIREMENTS
The successful candidate for this position should meet the following requirements:
- 0-3 years of experience in information security, information technology, technology risk, audit, compliance, or a related area.
- Foundational understanding of cybersecurity principles, information security risk, and internal control concepts.
- Willingness to obtain industry certifications such as CompTIA Security+, Certified Information Systems Auditor (CISA), or equivalent.
Preferred experience/knowledge:
- Bachelor’s degree in information systems, cybersecurity, computer science, risk management, business or a related field.
- Exposure to banking, financial services, insurance, or another regulated environment.
- Introductory familiarity with CIS Critical Security Controls, FFIEC guidance, and other similar frameworks.
- Basic familiarity with access controls, vulnerability management, phishing, risk assessments, control testing, or IT General Controls.
- Relevant coursework or interest in pursuing an entry-level certification, such as CompTIA Security+, ISC2 Certified in Cybersecurity, or ISACA IT Risk Fundamentals or Cybersecurity Fundamentals Certificate.
Required Knowledge, Skills, and/or Abilities
- Basic understanding of information security principles, risk management, and internal control practices.
- Strong interpersonal skills; must be able to interface professionally and collaboratively with all levels of associates.
- Ability to work in a dynamic environment, handle multiple priorities and manage workload based on evolving business needs and regulatory expectations.
- Ability to work proactively and identify solutions to business problems with consideration for known constraints.
- Strong attention to detail and ability to organize information, maintain accurate records, and follow documented procedures.
- Basic proficiency with the Microsoft Office suite (i.e. Word, Excel, Visio and PowerPoint).
SUPERVISORY SCOPE:
Not applicable.
INDEPENDENT ACTION:
Establishes short-range plans aligned with the strategic Enterprise Risk Management objectives.
QUALIFICATIONS:
To perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed above are representative of the knowledge, skill, and/or ability required. Any physical demands or work conditions described here are representative of those that must be met by an employee to successfully perform the essential functions of this job. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.
Similar Jobs
Consumer Web • eCommerce • Information Technology • Retail • Software • Analytics • App development
Performs merchandising resets, display setup, signage and pricing updates, product organization, buyback preparation, and repairs in Lowe’s stores. Ensures displays are safe, clean, accurate, and accessible while assisting customers with product information and locating merchandise. Communicates project priorities, documents completion, analyzes execution metrics, and provides feedback to store and corporate leaders. The role requires basic math, communication, computer skills, physical stamina, and occasional travel to meetings, training, or nearby stores.
Top Skills:
DrillsHand ToolsLiftsOrder PickersPlanogramsSawsWeb-Based Computer Programs
Consumer Web • eCommerce • Information Technology • Retail • Software • Analytics • App development
Pick, stage, inspect, and fulfill customer orders accurately and on time. Maintain clean and safe staging areas, provide customer service, operate certified powered equipment, support inventory accuracy using retail technology, complete audits and readiness tasks, and report safety or theft concerns. The role requires teamwork, communication, computer and retail technology proficiency, and powered equipment certification.
Top Skills:
Counterbalance ForkliftNarrow Aisle Reach TruckOrder PickerOrders AppSimsSmartphoneTablet
Big Data • Information Technology • Software • Analytics • Energy
Own enterprise sales and account growth for energy-focused SaaS solutions. Build executive relationships, generate qualified pipeline, lead consultative sales pursuits, align solutions with strategic business objectives, develop presentations and ROI cases, negotiate and close opportunities, manage renewals and upsells, and maintain accurate Salesforce and sales database records.
Top Skills:
Generative AiMicrosoft AccessExcelMS OfficeMicrosoft OutlookMicrosoft PowerpointMicrosoft WordSaaSSalesforce
What you need to know about the Boston Tech Scene
Boston is a powerhouse for technology innovation thanks to world-class research universities like MIT and Harvard and a robust pipeline of venture capital investment. Host to the first telephone call and one of the first general-purpose computers ever put into use, Boston is now a hub for biotechnology, robotics and artificial intelligence — though it’s also home to several B2B software giants. So it’s no surprise that the city consistently ranks among the greatest startup ecosystems in the world.
Key Facts About Boston Tech
- Number of Tech Workers: 269,000; 9.4% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Thermo Fisher Scientific, Toast, Klaviyo, HubSpot, DraftKings
- Key Industries: Artificial intelligence, biotechnology, robotics, software, aerospace
- Funding Landscape: $15.7 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Summit Partners, Volition Capital, Bain Capital Ventures, MassVentures, Highland Capital Partners
- Research Centers and Universities: MIT, Harvard University, Boston College, Tufts University, Boston University, Northeastern University, Smithsonian Astrophysical Observatory, National Bureau of Economic Research, Broad Institute, Lowell Center for Space Science & Technology, National Emerging Infectious Diseases Laboratories
