Risk Analyst resume example

• Scoped third-party assessments by service, data access, business criticality, geography, and dependency concentration; matched assessment depth to actual exposure instead of using one questionnaire for every vendor.
• Reviewed SOC reports, ISO certifications, PCI evidence, policies, and test results for control design and operating effectiveness; separated verified controls from claims and expired evidence.
• Documented findings with exposure, likelihood, control gap, compensating measures, due dates, and risk owners; gave business and security owners a clear basis for acceptance, remediation, or exit.
• Linked vendor access and data sensitivity to the assessment scope, checked SOC report exceptions with control owners, and tracked overdue remediation evidence before renewing assurance.
• Owned a third-party cybersecurity risk assessment using assurance artifacts, resolved a control-design inconsistency and completed a remediation recommendation with the risk owner.
• Published risk metrics using reviewed evidence age and severity, reduced overdue remediation follow-ups by 28% and documented the residual-risk acceptance decision.

• Monitored material vendors for assurance changes, incidents, service shifts, and overdue remediation evidence. Triggered reassessment when exposure changed instead of waiting for the annual cycle.
• Reviewed remediation evidence against the original finding, retested the affected access path, and kept residual exposure visible when the mitigation could not remove the entire risk.
• Mapped a third-party service to the data it could access, assessed the control design and operating effectiveness using the SOC report, and reviewed unresolved remediation with business and security stakeholders before renewal.

• Documented findings with exposure, likelihood, control gap, compensating measures, due dates, and risk owners
• Built a lab assessment using synthetic accounts and a published control framework; mapped each finding to the affected access path and kept evidence of both the vulnerable and remediated state.
• Retested the proposed control with an authorized negative case and wrote a residual-risk note; distinguished a passed laboratory check from assurance about an organization’s entire environment.
• Owned the authorized lab retest using synthetic accounts, resolved an access-control gap and completed a report showing both the blocked request and the permitted path.

Relevant coursework: Algorithms, operating systems, databases, computer networks

• Published an independent security note using redacted lab evidence, distinguishing a verified control from residual risk and explaining why a passed test is not whole-system assurance.