Note: The job is a remote job and is open to candidates in USA. Strategic Education Inc. is committed to enabling economic mobility through education, and they are seeking a Principal IT Risk Management Analyst to lead their IT risk management program. The successful candidate will be responsible for identifying, assessing, and managing technology risks while partnering with executive leadership to shape risk strategy and ensure effective communication of risks across the organization.
Responsibilities
- Lead and evolve the IT security risk management program in alignment with organizational goals, risk appetite, and risk tolerance
- Partner with executive leadership to shape risk strategy and drive enterprise-wide adoption
- Serve as a key advisor on risk posture, translating technical findings into strategic business decisions
- Identify, assess, and quantify technology risks by evaluating cybersecurity threats, operational vulnerabilities, and emerging technology risks using qualitative and quantitative methodologies
- Conduct risk assessments using established frameworks, including NIST CSF and CIS Controls v8
- Translate technical findings into clear, actionable business risk and support risk-based decision making
- Manage and maintain the enterprise IT risk register, including risk ownership, scoring, and lifecycle tracking
- Design and implement IT security risk mitigation strategies and controls aligned with industry standards
- Lead the risk exception management process, including evaluation, documentation, and risk acceptance decisions
- Provide risk-informed guidance for complex technology initiatives, including emerging areas such as artificial intelligence and machine learning
- Integrate IT security risk management practices into business and technology processes
- Support the development and lifecycle management of information security policies and standards
- Define and evolve risk metrics, key risk indicators (KRIs), and risk appetite thresholds
- Develop dashboards and reporting that translate risk data into actionable insights for executive and board-level audiences
- Communicate complex risk concepts clearly to both technical and non-technical stakeholders
- Drive adoption of IT security risk platforms and workflow automation to improve efficiency and scalability
- Identify and implement automation opportunities across risk management workflows
- Continuously enhance risk methodologies, tools, and processes
- Stay current on the evolving threat landscape, emerging technologies, and industry practices
- Mentor and guide junior team members in direct or matrixed reporting relationships
- Lead or own workstreams while providing direction and support to junior analysts
Skills
- Bachelor's degree in a relevant discipline required
- 5+ years of IT risk management experience, with a focus on risk assessment, quantification, and risk register ownership (not primarily compliance or audit)
- 3+ years mentoring or leading team members
- Demonstrated experience mentoring analysts while owning and delivering discrete risk workstreams or program components
- Experience conducting risk assessments aligned to NIST CSF, CIS Controls v8, or similar frameworks
- Experience managing an IT risk register, risk exception processes, and residual risk documentation
- Experience developing risk metrics, dashboards, and executive reporting
- Experience with GRC platforms and workflow automation in a risk context
- Experience managing risks related to emerging technologies, including artificial intelligence
- Strong leadership, analytical, and problem-solving skills with a risk-first mindset
- Demonstrated team leadership through mentoring, coaching, or leading analysts
- Ability to own workstreams and guide junior staff in a matrixed environment
- Strong technical depth to identify risks, evaluate control effectiveness, and translate vulnerability and technical data into business risk
- Deep knowledge of NIST CSF, CIS Controls v8, and related frameworks
- Proven ability to build and manage an enterprise IT risk register and exception management program
- Experience building and evolving risk metrics, KRIs, dashboards, and executive reporting
- Hands-on experience with GRC platforms and workflow automation tools (e.g., Archer, ServiceNow GRC, OneTrust, Jira, Rapid7 Nexpose) and the ability to automate processes
- Understanding of AI/ML risk domains, including model risk, data integrity, bias, and adversarial threats, with the ability to recommend controls
- Experience drafting, reviewing, and improving information security policies and standards
- Ability to communicate technical concepts and residual risk clearly to non-technical stakeholders
- Master's degree preferred
- CRISC (ISACA)
- CISSP (ISC²)
- CISM (ISACA)
- CompTIA Security+
- CompTIA CySA+
- CompTIA CASP+
- CGEIT (ISACA)
Benefits
- Medical, dental, vision, life and disability plans
- Well-being incentives
- Parental leave
- Paid time off
- Certain paid holidays
- Tax saving accounts (FSA, HSA)
- 401(k) retirement benefit
- Employee Stock Purchase Plan
- Tuition assistance
- Entertainment and retail discounts
- Overtime pay, if applicable
Company Overview
Company H1B Sponsorship