Staff Security Risk Analyst

Staff Security Risk Analyst  

Responsibilities:

• Identify, assess, monitor, and report on operational, security, and compliance risks.
• Drive technical automation across the risk management lifecycle by engineering custom AI agents, capabilities, and workflows to optimize risk data processing and scale operations.
• Evaluate security control effectiveness, track deficiencies, and drive engineering remediation activities to closure.
• Conduct root cause analysis on control deficiencies and post-incident reviews to identify underlying gaps and prevent recurrence.
• Partner with the risk owners to develop mitigation plans in line with the risk management strategy. 
• Govern the formal risk acceptance and exception process. 
• Manage the risk register and issue lifecycle to deliver dynamic risk visibility to leadership.
• Apply industry best practice for risk management across Okta, and provide insight into applying regulatory and industry frameworks to Okta’s security posture.
• Build strong partnerships with cross functional teams to foster a cohesive view of security, compliance, and operational risks and drive remediation to closure.
• Serve as a security and technology subject matter expert within the security organization; provide critical advisory in the design and adoption of security controls, particularly those intended to meet regulatory requirements.
• Develop data analytics workflows and establish KRIs and KPIs to elevate team metrics and executive reporting.
• Develop, maintain, and continuously refine standardized risk assessment methodologies, playbooks, and procedures.
• Drive security risk management program maturity and execution, aligning risk governance with the company’s goals and security strategy.
• Drive risk-awareness initiatives and champion a security-minded risk culture across business units.
• Support ad hoc projects including program enhancements, security initiatives, and other GRC functions.

Requirements:

• Relevant BA/BS degree.
• 7+ years of hands-on security risk management and technical experience.
• Hands-on experience building automated workflows, scripts (Python/APIs), and AI agentic solutions. 
• Industry certification in security (CRISC, CISA, CISM, CISSP) or equivalent certification.
• Experience across regulations and common industry frameworks including but not limited to ISO, PCI, NIST CSF, COSO, and others. 
• Preferred experience in Third-Party Risk Management, including hands-on execution of vendor security assessments and overall program operations.
• Track record of effectively influencing technical and business stakeholders to drive risk remediation and process adoption.
• Strong knowledge of agile tools and GRC solutions.
• Excellent verbal, written, and interpersonal skills.
• Ability to manage multiple priority initiatives and deliver results under tight timelines.
• Comfortable with ambiguity and adaptable to fast changing environments.

#LI-HYBRID

P19885_3588715