Internship Risk Analyst resume example

• Under supervision, linked vendor access and data sensitivity to the assessment scope, checked SOC report exceptions with control owners, and tracked overdue remediation evidence before renewing assurance.
• The team scoped third-party assessments by service, data access, business criticality, geography, and dependency concentration; I supported research preparation, validation, and documentation under mentor review. The team matched assessment depth to actual exposure instead of using one questionnaire for every vendor; confirmed with my mentor that my contribution was limited to the assigned support and validation work.
• The team reviewed SOC reports, ISO certifications, PCI evidence, policies, and test results for control design and operating effectiveness; I supported research preparation, validation, and documentation under mentor review. The team separated verified controls from claims and expired evidence; confirmed with my mentor that my contribution was limited to the assigned support and validation work.
• Under supervision, owned a third-party cybersecurity risk assessment using assurance artifacts, resolved a control-design inconsistency and completed a remediation recommendation with the risk owner.
• Under supervision, published risk metrics using reviewed evidence age and severity, reduced overdue remediation follow-ups by 28% and documented the residual-risk acceptance decision.

• In a mentor-reviewed simulation, scoped third-party assessments by service, data access, business criticality, geography, and dependency concentration; matched assessment depth to actual exposure instead of using one questionnaire for every vendor.
• As a second supervised exercise, reviewed SOC reports, ISO certifications, PCI evidence, policies, and test results for control design and operating effectiveness; separated verified controls from claims and expired evidence.
• Under supervision, the team documented findings with exposure, likelihood, control gap, compensating measures, due dates, and risk owners; I supported research preparation, validation, and documentation under mentor review
• Built a lab assessment using synthetic accounts and a published control framework; mapped each finding to the affected access path and kept evidence of both the vulnerable and remediated state.
• Retested the proposed control with an authorized negative case and wrote a residual-risk note; distinguished a passed laboratory check from assurance about an organization’s entire environment.
• Owned the authorized lab retest using synthetic accounts, resolved an access-control gap and completed a report showing both the blocked request and the permitted path.

Relevant coursework: Algorithms, operating systems, databases, computer networks

• Published an independent security note using redacted lab evidence, distinguishing a verified control from residual risk and explaining why a passed test is not whole-system assurance.