Information Security Risk Analyst Jobs
Information Security Risk Analyst jobs are open across financial services, healthcare, government, defense, and technology, from junior analyst to senior and principal levels, with specializations in threat and vulnerability management, GRC frameworks, and third-party risk. See the openings below and apply to the ones that match your experience.
Find JobsOverview
Showing 5 of 34+ Information Security Risk Analyst jobs
Job Posting:
Since 1953, Ferguson has been a source of quality supplies for a variety of industries. Together We Build Better infrastructure, better homes and better businesses. We exist to make our customers’ complex projects simple, successful, and sustainable. We proactively solve problems, adapt and grow to continuously serve our customers, communities and each other. Ferguson, a Fortune 500 company, is proud to provide best-in-class products, service and capabilities across the following industries: Commercial/Mechanical, Facilities Supply, Fire and Fabrication, HVAC, Industrial, Residential Trade, Residential Building and Remodel, Waterworks and Residential Digital Commerce. Ferguson has approximately 36,000 associates across 1,700 locations. Ferguson is a community of proud associates who operate with the shared purpose of building something meaningful. You will build a career that you are proud of, at a company you can believe in.
Principal Information Security Engineer – Governance & Risk
The Principal Information Security Engineer – IT Governance & Risk plays a key role in advancing Ferguson’s enterprise cybersecurity risk and governance strategy. This highly visible position leads several critical security programs, including Third-Party Risk Assessment (TPRA), NIST Cybersecurity Framework (CSF) transformation, external security posture management, and cybersecurity risk oversight.
As a senior cybersecurity subject matter expert, this role will drive the continued evolution of Ferguson’s third-party risk program, modernizing assessment processes to improve efficiency, scalability, business customer engagement, and risk-based decision-making. The Principal Engineer will also lead efforts to mature Ferguson’s adoption of the NIST CSF, establishing sustainable governance and measurement practices that align cybersecurity capabilities with enterprise risk and business priorities.
The role also provides strategic oversight of Ferguson’s external security posture and cyber exposure, including BitSight security ratings, continuous third-party monitoring, attack surface visibility, remediation tracking, and executive-level reporting. In addition, this position leads cybersecurity support for Ferguson’s annual cyber insurance renewal, partnering with Risk Management, Legal, and executive leadership to demonstrate control effectiveness, assess readiness against underwriting requirements, and strengthen the organization’s overall risk posture.
Working across Information Security, Technology, Internal Audit, Procurement, Legal, Enterprise Risk Management, and business leadership, the Principal Engineer serves as a trusted advisor on complex cybersecurity risks and governance decisions. This is an opportunity to shape enterprise security programs, influence how cyber risk is measured and managed, and drive meaningful improvements in Ferguson’s overall security maturity and resilience.
Location: This role is approved to be fully remote and can be based anywhere in the United States.
Duties & Responsibilities:
Governance & Risk
- Lead enterprise cybersecurity risk assessments using the NIST Cybersecurity Framework (CSF).
- Assess and measure cybersecurity program maturity and find opportunities for improvement.
- Develop recommendations and remediation plans to address security control gaps and risk exposures.
- Partner with technology and business teams to improve governance and risk management.
- Support development and maintenance of security roadmaps, governance processes, and performance metrics.
- Coordinate independent security assessments, audits, and risk reviews.
Third-Party Risk Management
- Lead security assessments of vendors, suppliers, and technology partners.
- Review security questionnaires, penetration test reports, SOC reports, and compliance documentation.
- Identify, assess, and communicate third-party security risks and remediation recommendations.
- Support contract reviews to ensure appropriate security requirements are incorporated.
Security Awareness & Education
- Contribute and support Ferguson's Security Awareness Program.
Metrics & Reporting
- Develop dashboards, scorecards, and executive reporting related to cybersecurity risk and program performance.
- Define and track Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and security maturity metrics.
- Leverage automation and reporting tools to improve efficiency and visibility across GRC programs.
Leadership & Influence
- Serve as a trusted advisor and domain expert for cybersecurity governance and risk management.
- Develop risk reporting methodologies that translate technical risks into business impact.
- Partner with business leaders to prioritize remediation efforts based on risk exposure, likelihood, and potential business impact.
- Support development of cybersecurity and enterprise risk dashboards and executive reporting.
- Build strong relationships with business and technology customers.
- Communicate security risks, recommendations, and program performance to technical and non-technical audiences.
Qualifications & Requirements:
- Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field. Equivalent combination of education and experience will be considered.
- 5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines.
- Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments.
- Experience developing security policies, standards, and governance processes.
- Experience supporting audits, compliance initiatives, and third-party risk management programs.
- Experience presenting findings and recommendations to leadership and business stakeholders.
- Preferred Certifications: CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor/Implementer
Knowledge, Skills & Abilities
- Solid understanding of NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls.
- Knowledge of cybersecurity risk management, security governance, third-party risk management, and compliance frameworks.
- Ability to assess and prioritize risk across applications, infrastructure, cloud services, and vendors.
- Strong analytical, problem-solving, and critical thinking skills.
- Excellent written, verbal, and presentation communication skills.
- Strong stakeholder management and influencing capabilities.
- Experience with Microsoft technologies, cloud platforms, and security reporting solutions.
- Ability to lead sophisticated initiatives and drive outcomes through collaboration and influence.
At Ferguson, we care for each other. We value our well-being just as much as our hard work. We are committed to a holistic approach towards benefits plans and programs that support the mental, physical and financial well-being of our associates. Our competitive offering not only includes benefits like health, dental, vision, paid time off, life insurance and a 401(k) with a company match, but our associates also enjoy additional meaningful and inclusive enhancements that are adaptable to their diverse situations and needs, including mental health coverage, gender affirming and family building benefits, paid parental leave, associate discounts, community involvement opportunities and more!
#LI-REMOTE
Pay Range:
Actual pay rate may vary depending upon location. The estimated pay range for this position is below. The specific rate will depend on a candidate’s qualifications and prior experience.
Estimated Ranges displayed are Monthly for Salaried roles OR Hourly for all other roles.
This role is Bonus or Incentive Plan eligible.
Ferguson complies with all wage regulations. The starting wage may be higher in certain locations based on local or state wage requirements.
The Company is an equal opportunity employer as well as a government contractor that shall abide by the requirements of 41 CFR 60-300.5(a), which prohibits discrimination against qualified protected Veterans and the requirements of 41 CFR 60-741.5(A), which prohibits discrimination against qualified individuals on the basis of disability.
Ferguson Enterprises, LLC. is an equal employment employer F/M/Disability/Vet/Sexual Orientation/Gender Identity.
Equal Employment Opportunity and Reasonable Accommodation Information
Job Posting:
Since 1953, Ferguson has been a source of quality supplies for a variety of industries. Together We Build Better infrastructure, better homes and better businesses. We exist to make our customers’ complex projects simple, successful, and sustainable. We proactively solve problems, adapt and grow to continuously serve our customers, communities and each other. Ferguson, a Fortune 500 company, is proud to provide best-in-class products, service and capabilities across the following industries: Commercial/Mechanical, Facilities Supply, Fire and Fabrication, HVAC, Industrial, Residential Trade, Residential Building and Remodel, Waterworks and Residential Digital Commerce. Ferguson has approximately 36,000 associates across 1,700 locations. Ferguson is a community of proud associates who operate with the shared purpose of building something meaningful. You will build a career that you are proud of, at a company you can believe in.
Principal Information Security Engineer – Governance & Risk
The Principal Information Security Engineer – IT Governance & Risk plays a key role in advancing Ferguson’s enterprise cybersecurity risk and governance strategy. This highly visible position leads several critical security programs, including Third-Party Risk Assessment (TPRA), NIST Cybersecurity Framework (CSF) transformation, external security posture management, and cybersecurity risk oversight.
As a senior cybersecurity subject matter expert, this role will drive the continued evolution of Ferguson’s third-party risk program, modernizing assessment processes to improve efficiency, scalability, business customer engagement, and risk-based decision-making. The Principal Engineer will also lead efforts to mature Ferguson’s adoption of the NIST CSF, establishing sustainable governance and measurement practices that align cybersecurity capabilities with enterprise risk and business priorities.
The role also provides strategic oversight of Ferguson’s external security posture and cyber exposure, including BitSight security ratings, continuous third-party monitoring, attack surface visibility, remediation tracking, and executive-level reporting. In addition, this position leads cybersecurity support for Ferguson’s annual cyber insurance renewal, partnering with Risk Management, Legal, and executive leadership to demonstrate control effectiveness, assess readiness against underwriting requirements, and strengthen the organization’s overall risk posture.
Working across Information Security, Technology, Internal Audit, Procurement, Legal, Enterprise Risk Management, and business leadership, the Principal Engineer serves as a trusted advisor on complex cybersecurity risks and governance decisions. This is an opportunity to shape enterprise security programs, influence how cyber risk is measured and managed, and drive meaningful improvements in Ferguson’s overall security maturity and resilience.
Location: This role is approved to be fully remote and can be based anywhere in the United States.
Duties & Responsibilities:
Governance & Risk
- Lead enterprise cybersecurity risk assessments using the NIST Cybersecurity Framework (CSF).
- Assess and measure cybersecurity program maturity and find opportunities for improvement.
- Develop recommendations and remediation plans to address security control gaps and risk exposures.
- Partner with technology and business teams to improve governance and risk management.
- Support development and maintenance of security roadmaps, governance processes, and performance metrics.
- Coordinate independent security assessments, audits, and risk reviews.
Third-Party Risk Management
- Lead security assessments of vendors, suppliers, and technology partners.
- Review security questionnaires, penetration test reports, SOC reports, and compliance documentation.
- Identify, assess, and communicate third-party security risks and remediation recommendations.
- Support contract reviews to ensure appropriate security requirements are incorporated.
Security Awareness & Education
- Contribute and support Ferguson's Security Awareness Program.
Metrics & Reporting
- Develop dashboards, scorecards, and executive reporting related to cybersecurity risk and program performance.
- Define and track Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), and security maturity metrics.
- Leverage automation and reporting tools to improve efficiency and visibility across GRC programs.
Leadership & Influence
- Serve as a trusted advisor and domain expert for cybersecurity governance and risk management.
- Develop risk reporting methodologies that translate technical risks into business impact.
- Partner with business leaders to prioritize remediation efforts based on risk exposure, likelihood, and potential business impact.
- Support development of cybersecurity and enterprise risk dashboards and executive reporting.
- Build strong relationships with business and technology customers.
- Communicate security risks, recommendations, and program performance to technical and non-technical audiences.
Qualifications & Requirements:
- Bachelor's degree in Information Security, Cybersecurity, Information Systems, Computer Science, Business Administration, or related field. Equivalent combination of education and experience will be considered.
- 5+ years of experience in Information Security, IT Risk Management, Compliance, IT Audit, Cybersecurity Governance, or related disciplines.
- Experience conducting security risk assessments and evaluating security controls in on-premises and cloud environments.
- Experience developing security policies, standards, and governance processes.
- Experience supporting audits, compliance initiatives, and third-party risk management programs.
- Experience presenting findings and recommendations to leadership and business stakeholders.
- Preferred Certifications: CISSP, CISM, CRISC, CISA, or ISO 27001 Lead Auditor/Implementer
Knowledge, Skills & Abilities
- Solid understanding of NIST CSF, ISO 27001, COBIT, COSO, and IT General Controls.
- Knowledge of cybersecurity risk management, security governance, third-party risk management, and compliance frameworks.
- Ability to assess and prioritize risk across applications, infrastructure, cloud services, and vendors.
- Strong analytical, problem-solving, and critical thinking skills.
- Excellent written, verbal, and presentation communication skills.
- Strong stakeholder management and influencing capabilities.
- Experience with Microsoft technologies, cloud platforms, and security reporting solutions.
- Ability to lead sophisticated initiatives and drive outcomes through collaboration and influence.
At Ferguson, we care for each other. We value our well-being just as much as our hard work. We are committed to a holistic approach towards benefits plans and programs that support the mental, physical and financial well-being of our associates. Our competitive offering not only includes benefits like health, dental, vision, paid time off, life insurance and a 401(k) with a company match, but our associates also enjoy additional meaningful and inclusive enhancements that are adaptable to their diverse situations and needs, including mental health coverage, gender affirming and family building benefits, paid parental leave, associate discounts, community involvement opportunities and more!
#LI-REMOTE
Pay Range:
Actual pay rate may vary depending upon location. The estimated pay range for this position is below. The specific rate will depend on a candidate’s qualifications and prior experience.
Estimated Ranges displayed are Monthly for Salaried roles OR Hourly for all other roles.
This role is Bonus or Incentive Plan eligible.
Ferguson complies with all wage regulations. The starting wage may be higher in certain locations based on local or state wage requirements.
The Company is an equal opportunity employer as well as a government contractor that shall abide by the requirements of 41 CFR 60-300.5(a), which prohibits discrimination against qualified protected Veterans and the requirements of 41 CFR 60-741.5(A), which prohibits discrimination against qualified individuals on the basis of disability.
Ferguson Enterprises, LLC. is an equal employment employer F/M/Disability/Vet/Sexual Orientation/Gender Identity.
Equal Employment Opportunity and Reasonable Accommodation Information
Information Security Risk Analyst Jobs by Experience Level
See All 34 Information Security Risk Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsInformation Security Risk Analyst Job Market
Who's Hiring
Top Industries Hiring
- Healthcare & Medical Services
- Staffing & Recruiting
What Employers Look For
The qualifications that appear most often in information security risk analyst jobs.
- Bachelor's degree in information security, computer science, or a related field
- Hands-on experience conducting risk assessments using NIST CSF or ISO 27001
- Proficiency with GRC platforms such as Archer, ServiceNow GRC, or similar tools
- Professional certification such as CISSP, CISM, CRISC, or CompTIA Security+
- Demonstrated ability to identify, evaluate, and document third-party vendor risks
- Familiarity with regulatory requirements including SOX, HIPAA, PCI DSS, or GDPR
Tips for Your Information Security Risk Analyst Job Search
Tailor your resume to framework language
Hiring managers scan for NIST CSF, ISO 27001, and COBIT fluency by keyword. Map your actual experience to those frameworks explicitly on your resume rather than listing generic risk or compliance duties. Vague descriptions get filtered out fast.
Lead with certifications above your summary
CISSP, CISM, CRISC, and Security+ carry significant weight in information security risk analyst postings. If you hold any, place them immediately after your name so a recruiter skimming the top of the page sees them without scrolling.
Apply early to roles that fit
Migrate Mate lists information security risk analyst openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Filter for industry-specific risk scope
Financial services and healthcare postings often require sector-specific regulatory knowledge such as SOX, HIPAA, or PCI DSS. Target your search by industry first, then seniority, so your application speaks directly to what that employer actually needs to audit.
Prepare a risk scenario walkthrough
Interviewers frequently ask you to walk through a risk assessment you owned end to end. Prepare a concise narrative covering your methodology, stakeholder communication, and final risk decision. Generic answers about process lose out to concrete examples with clear outcomes.
Negotiate scope and reporting structure
Before accepting any offer, clarify whether the role reports to a CISO, a compliance function, or IT operations. That structure shapes how much authority you have to escalate risk findings. Asking this question also signals maturity and strategic thinking to the hiring team.
Information Security Risk Analyst Jobs: Frequently Asked Questions
Which companies are hiring the most information security risk analysts?
The companies hiring the most information security risk analysts right now include Booz Allen Hamilton, AltaMed Health Services, and Wawa, with the largest share of openings in New York, Hawaii, and New Mexico, based on current listings on Migrate Mate as of November 2026. Financial services firms and large healthcare systems tend to maintain the deepest ongoing demand for this role.
How many information security risk analyst jobs are remote?
About 71% of information security risk analyst openings are fully remote or hybrid as of November 2026, reflecting strong employer flexibility for this role. GRC and third-party risk functions tend to be the most remote-friendly sub-areas, while roles tied to on-premises infrastructure or regulated environments more often require in-office presence at least part of the week.
How do you become an information security risk analyst?
Start with a bachelor's degree in information security, computer science, or a related discipline, then build foundational knowledge through entry-level IT or security support roles. Earn a recognized certification such as CompTIA Security+, then progress to CRISC or CISM as you gain risk-specific experience. Hands-on work with a GRC platform and direct involvement in a formal risk assessment process are the fastest ways to qualify for analyst-level postings.
Can you get hired as an information security risk analyst with little experience?
Yes, some employers hire candidates with limited direct risk experience when they demonstrate adjacent skills in IT audit, compliance, or security operations. Building a portfolio that includes a completed risk assessment, even a self-directed one using the NIST CSF on a practice environment, shows practical capability. Entry-level GRC analyst and junior security analyst roles are the most accessible starting points, and they often transition directly into full risk analyst responsibilities within one to two years.
What does the information security risk analyst interview process look like?
Most employers run three to four stages: an initial screening with a recruiter, a technical panel where you walk through a past risk assessment and answer scenario-based questions, and a final interview with the CISO or compliance leadership. Some organizations add a written exercise asking you to evaluate a hypothetical vendor or identify gaps in a control framework. References and a background check typically close the process before an offer is extended.
Where can I find and apply to information security risk analyst jobs?
You can find and apply to information security risk analyst jobs on Migrate Mate, which lists current openings from across the United States. Search for roles that match your experience level, industry focus, and preferred work arrangement, then apply directly to each listing that fits.
See All 34 Information Security Risk Analyst Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs