Entry-level Risk Analyst resume example

• With a senior colleague reviewing the change, scoped third-party assessments by service, data access, business criticality, geography, and dependency concentration; matched assessment depth to actual exposure instead of using one questionnaire for every vendor.
• Within an assigned workstream, reviewed SOC reports, ISO certifications, PCI evidence, policies, and test results for control design and operating effectiveness; separated verified controls from claims and expired evidence.
• With a senior colleague reviewing the change, documented findings with exposure, likelihood, control gap, compensating measures, due dates, and risk owners; gave business and security owners a clear basis for acceptance, remediation, or exit.
• Within the assigned scope, linked vendor access and data sensitivity to the assessment scope, checked SOC report exceptions with control owners, and tracked overdue remediation evidence before renewing assurance.
• Within the assigned scope, owned a third-party cybersecurity risk assessment using assurance artifacts, resolved a control-design inconsistency and completed a remediation recommendation with the risk owner.
• Within the assigned scope, published risk metrics using reviewed evidence age and severity, reduced overdue remediation follow-ups by 28% and documented the residual-risk acceptance decision.

• The team monitored material vendors for assurance changes, incidents, service shifts, and overdue remediation evidence; my scope was data preparation, quality checks, and follow-up documentation under senior review. The team triggered reassessment when exposure changed instead of waiting for the annual cycle; documented my assigned work separately from the team result and confirmed it with a senior colleague.
• Within the assigned scope, reviewed remediation evidence against the original finding, retested the affected access path, and kept residual exposure visible when the mitigation could not remove the entire risk.
• Within the assigned scope, mapped a third-party service to the data it could access, assessed the control design and operating effectiveness using the SOC report, and reviewed unresolved remediation with business and security stakeholders before renewal.

• Within the assigned scope, the team documented findings with exposure, likelihood, control gap, compensating measures, due dates, and risk owners; my scope was data preparation, quality checks, and follow-up documentation under senior review
• Built a lab assessment using synthetic accounts and a published control framework; mapped each finding to the affected access path and kept evidence of both the vulnerable and remediated state.
• Retested the proposed control with an authorized negative case and wrote a residual-risk note; distinguished a passed laboratory check from assurance about an organization’s entire environment.
• Owned the authorized lab retest using synthetic accounts, resolved an access-control gap and completed a report showing both the blocked request and the permitted path.

Relevant coursework: Algorithms, operating systems, databases, computer networks

• Published an independent security note using redacted lab evidence, distinguishing a verified control from residual risk and explaining why a passed test is not whole-system assurance.