Cyber Security Analyst 2//San Jose, CA OR Austin, TX

Hi,My name is Sudheer, and I work with TPI Global Solutions. We are a global talent solutions firm providing a wide range of staffing solutions to companies and candidates within the technology field.I have reviewed your profile on one of the Job Portal and feel that your background could be a great fit for an exciting opportunity I am working on right now.Title: IT - Cyber Security Analyst 2Client: AMDLocation: San Jose, CA OR Austin, TX (hybrid, 3 days onsite per week)Duration: 12 + Months  Job Description: We are seeking a detail-oriented GRC Risk Management Analyst to support information security and third-party risk management. The role combines structured governance and risk analysis with hands-on technical understanding to evaluate vendors throughout the relationship lifecycle—from onboarding and due diligence through ongoing monitoring and offboarding. The analyst will examine architectures, security controls, configurations, technical evidence, and threat scenarios to identify control gaps, determine business impact, document defensible risk decisions, and support practical remediation. The role will also apply analytics, automation, and AI responsibly to streamline evidence review, improve assessment quality, and accelerate monitoring and reporting while maintaining human validation, data protection, traceability, and appropriate governance.Key Responsibilities

      Conduct end-to-end third-party risk assessments, including due diligence, inherent-risk tiering, control evaluation, residual-risk determination, periodic reassessment, and offboarding reviewAdminister risk-based vendor questionnaires covering security governance, data protection, access control, vulnerability management, incident response, business continuity, cloud services, and subcontractor oversight;review responses and supporting evidence, clarify gaps with vendors, and translate findings into risk ratings and remediation actions

      Maintain enterprise and vendor risk registers with clear risk statements, ratings, owners, treatment plans, and statusAnalyze security, privacy, resilience, regulatory, concentration, and fourth-party risks based on business criticality and data sensitivity

      Perform technical risk analysis by reviewing system architecture, data flows, cloud and network configurations, identity and access models, encryption, logging, vulnerability results, penetration-test findings, software dependencies, and incident-response capabilities;distinguish design intent from operating effectiveness and document evidence-based conclusionsApply hands-on security knowledge to validate control implementation through practical review of technical artifacts, targeted demonstrations, sample-based testing, and collaboration with engineers and system owners;translate technical weaknesses and threat scenarios into clear likelihood, impact, residual-risk, and remediation recommendations

      Partner with Security, IT, Legal, Privacy, Procurement, and business owners to validate findings and drive proportionate mitigationTrack remediation, escalate material risks and exceptions, and prepare concise leadership reporting, including KRIs, trends, and heat maps

      Support policy governance, control testing, issue management, compliance monitoring, and alignment with NIST, ISO 27001, CMMC, and applicable requirementsDesign and use analytics, automation, and AI-assisted workflows to improve questionnaire triage, evidence extraction, control mapping, risk-statement drafting, issue classification, continuous monitoring, and reporting;measure process gains and maintain human approval, secure handling of sensitive data, output validation, auditability, and compliance with organizational AI governance requirementsRequired Qualifications

      Education: Bachelor’s degree in Information Security, Risk Management, Business, Computer Science, or a related fieldExperience: 1–4 years in enterprise risk, third-party risk, GRC, information security, or a related area

      Knowledge of inherent and residual risk, likelihood and impact, controls, treatment, acceptance, and monitoringWorking technical knowledge of enterprise and cloud environments, including networking, operating systems, identity and access management, encryption, secure configuration, vulnerability management, logging and monitoring, application security, and incident response

      Ability to interpret technical evidence such as architecture and data-flow diagrams, access reviews, configuration outputs, vulnerability and penetration-test reports, security logs, and independent assurance reports, and to identify when deeper technical validation is requiredAbility to assess business impact, apply risk criteria, and communicate clear, defensible recommendations

      Strong analytical, organizational, stakeholder-management, and written and verbal communication skillsProficiency with Microsoft Office and familiarity with GRC, analytics, or automation tools

      Practical experience using generative AI, scripting, workflow automation, or low-code tools to improve repeatable business processes, with an understanding of prompt design, output validation, sensitive-data handling, access controls, model limitations, and responsible human oversightMust be able to commute to San Jose, CA or Austin, TX and work on-site at least 3 days per weekPreferred Qualifications

      Relevant certification or active pursuit, such as Security+ or an AI fundamentals credentialExperience with GRC platforms, vendor monitoring tools, audit support, or control evidence collection

      Familiarity with NIST CSF, ISO 27001, CMMC, SOC 2, GDPR, CCPA, or similar requirementsExperience creating clear procedures, SOPs, or workflow documentation in a technology or regulated environment * * * * * *  * * * Sudheer PaswanSr Executive Resourcing | TPI Global Solutions* * * +1 4706329257 spaswan@tpiglobalsolutions.Com; www.Tpiglobalsolutions.Com