Cyber Risk Specialist II

Job Summary

The Cyber Risk Specialist is a member of the Cybersecurity GRC team responsible for identifying, assessing, analyzing, and reporting on cyber risks across the organization, with a specialized focus on risk metrics.

This role supports the development and maintenance of a data-driven cyber risk program by collecting, validating, analyzing, and communicating key risk indicators (KRIs), key performance indicators (KPIs), and other security metrics that inform leadership decision-making. The ideal candidate combines cybersecurity knowledge with strong analytical, reporting, and stakeholder communication skills.

This individual will help translate technical security data into meaningful business insights, support risk governance activities, and drive continuous improvement in cyber risk measurement and reporting.

Key Responsibilities

Cyber Risk Analysis

• Identify, assess, and document cybersecurity risks related to systems, applications, third parties, cloud environments, and business processes.
• Perform qualitative and quantitative cyber risk assessments using established risk frameworks and methodologies.
• Analyze control effectiveness and residual risk in coordination with cybersecurity, IT compliance, IT operations and business stakeholders.
• Maintain cyber risk registers and ensure risk records are current, complete, and aligned with organizational standards.
• Support exception management, risk acceptance processes, and remediation tracking.

Risk Metrics Management

• Develop, maintain, and enhance cyber risk metrics, dashboards, scorecards, and reporting packages for technical teams, leadership, and executive stakeholders.
• Define and monitor KRIs, KPIs, KCIs (Key Control Indicators), and trending metrics that measure cyber risk exposure and control performance.
• Collect data from multiple security and IT sources such as vulnerability management tools, SIEM platforms, GRC tools, endpoint security systems, audit findings, and incident records.
• Validate data quality, normalize metrics, and ensure reporting consistency across teams and reporting periods.
• Establish thresholds, escalation criteria, and tolerance levels for cyber risk indicators.
• Perform trend analysis and identify emerging risks, recurring control issues, and areas requiring management attention.
• Create visualizations and summaries that clearly communicate cyber risk posture to both technical and non-technical audiences.

Reporting and Governance

• Prepare recurring and ad hoc risk reports for governance committees, management reviews, audits, and regulatory assessments.
• Support the organization's cyber risk governance framework by providing timely and accurate reporting on risk posture and control performance.
• Assist with board-level or executive-level reporting by translating technical findings into business-focused risk narratives.
• Contribute to policy, standards, and procedure updates related to cyber risk measurement, documentation, and reporting.

Cross-Functional Collaboration

• Partner with vulnerability management, security operations, compliance, internal audit, enterprise risk, and IT teams to gather data and align reporting.
• Work with business stakeholders to understand operational context and improve risk measurement relevance.
• Support risk remediation planning by helping prioritize issues based on impact, exposure, and trend data.
• Participate in assessments related to third-party risk, cloud risk, application risk, and operational resilience as needed.

Continuous Improvement

• Recommend and implement enhancements to cyber risk measurement methodologies, reporting automation, and dashboard design.
• Improve data collection processes and help integrate metrics into GRC or security reporting platforms.
• Stay current on cybersecurity threats, risk management practices, industry standards, and emerging metrics approaches.

Required Qualifications

• Bachelor's degree in Cybersecurity, Information Technology, Information Systems, Risk Management, Data Analytics, or a related field (or equivalent practical experience).
• 3+ years of experience in cybersecurity, IT risk, information security governance, or cyber risk management.
• Experience developing, managing, or reporting on cybersecurity metrics, risk indicators, or dashboards.
• Strong understanding of cybersecurity principles, threats, vulnerabilities, controls, and risk management concepts.
• Experience with risk frameworks and standards such as:
• NIST Cybersecurity Framework (CSF)
• NIST Risk Management Framework (RMF)
• ISO 27001 / ISO 27005
• COBIT
• FAIR
• Proficiency in analyzing data and creating reports using tools such as Excel, Power BI, or similar reporting platforms.
• Experience working with security and risk data sources such as GRC tools, vulnerability scanners, SIEMs, ticketing systems, or audit repositories.
• Strong written and verbal communication skills, with the ability to present technical information in a business-friendly manner.
• Strong attention to detail, organizational skills, and analytical thinking.

Preferred Qualifications

• Experience in the manufacturing industry.
• Familiarity with control testing, audit support, compliance requirements, and issue management.
• Hands-on experience with tools such as OneTrust, Splunk, Qualys, Tenable, Nozomi or similar platforms.
• Knowledge of quantitative risk analysis methods and cyber risk scoring models.
• Experience with data automation, scripting, or querying tools such as SQL, Python, or PowerShell.
• Relevant certifications preferred, such as:
• CRISC
• CISM
• CISSP
• Security+
• CISA
• FAIR certification

Be Aware of Fraud

When applying for a job at Jabil you will be contacted via correspondence through our official job portal with a jabil.com e-mail address; direct phone call from a member of the Jabil team; or direct e-mail with a jabil.com e-mail address. Jabil does not request payments for interviews or at any other point during the hiring process.

Jabil will not ask for your personal identifying information such as a social security number, birth certificate, financial institution, driver's license number or passport information over the phone or via e-mail. If you believe you are a victim of identity theft, contact the Federal Bureau of Investigations internet crime hotline, the Federal Trade Commission identity theft hotline and/or your local police department.

Any scam job listings should be reported to whatever website it was posted in.

Accessibility Accommodation

• #whereyoubelong
• #AWorldofPossibilities