Associate Cyber Risk Analyst

The Associate Cyber Risk Analyst coordinates governance, risk, and compliance activities that support UFCU’s cybersecurity program. This role organizes participation in internal audits and third-party due diligence, maintains cybersecurity program knowledge and records, coordinates the development and lifecycle of security processes and procedures, and administers the security awareness training and phishing exercise program. The Associate Cyber Risk Analyst partners with Information Security, Risk Management, Internal Audit, Compliance, Legal, Human Resources, Technology, and business teams to collect evidence, track commitments, improve documentation, and promote secure behaviors across the organization.

The Associate Cyber Risk Analyst is an exempt position and reports to the Director, Information Security, and is part of the Information Security team at UFCU.

Our Credit Union was founded in 1936 and has grown to serve members throughout Texas and beyond. At UFCU, we are more than just a financial institution, and our people are more than just employees. We are dedicated to our purpose of empowering our Members to achieve financial success and build brighter futures.

In pursuit of our aspiration that UFCU is loved by millions of Members and built to thrive for generations, we are guided by our values:

• Purposefully Member-Obsessed: We are driven by a profound sense of empathy to deeply understand our Members’ needs and preferences, what brighter futures means to them, and the obstacles in their way. We act in our Members’ best interests, forever seeking to empower their financial success.
• Possibilities Reimagined: We are inspired to courageously experiment, learn, and iterate in pursuit of positive impact for our Members, UFCU, and coworkers. We challenge assumptions, embrace diverse perspectives, and make use of data and insights.
• Performance Excellence Rooted in Unwavering Integrity: We do the right thing, always. We champion teamwork, accountability, continuous improvement, and celebrate successful outcomes of others, fostering an inclusive environment of excellence and collaboration.

• Coordinate, organize, and manage Information Technology participation in internal audits, external audits, regulatory examinations, risk assessments, and control reviews.
• Maintain audit schedules, evidence inventories, request lists, stakeholder assignments, due dates, dependencies, and status reporting from initiation through closure.
• Collect, review, organize, and securely retain audit evidence to support accurate, complete, and timely responses.
• Facilitate meetings among auditors, vendors, control owners, subject matter experts, and leadership; document decisions, action items, and follow-up commitments.
• Track findings, management responses, remediation plans, and evidence of closure; escalate delays, risks, and resource constraints to Information Security leadership.

• Maintain the cybersecurity program’s authoritative documentation repository, including standards, procedures, control narratives, evidence, risk records, decisions, meeting materials, metrics, and program artifacts.
• Organize cybersecurity information using consistent taxonomy, naming, ownership, version control, retention, review dates, and access permissions.
• Coordinate recurring reviews with document owners to validate accuracy, remove obsolete content, and preserve institutional knowledge.
• Prepare dashboards, reports, presentations, and program updates that communicate cybersecurity activities, risks, trends, and commitments to technical and business audiences.
• Support records retention, legal hold, privacy, and confidentiality requirements for cybersecurity program information.

• Coordinate the development, review, approval, publication, and scheduled refresh of Information Security processes, procedures, standards, and supporting templates.
• Partner with process owners and subject matter experts to document roles, workflows, control points, inputs, outputs, dependencies, exceptions, and evidence requirements.
• Facilitate workshops and working sessions to identify gaps, resolve conflicting requirements, and align documentation with policy, risk, regulatory, and operational needs.
• Maintain document inventories, ownership assignments, approval records, revision history, review cadence, and exceptions.
• Monitor process adoption and effectiveness; recommend improvements based on audit results, incidents, metrics, stakeholder feedback, and changes in the threat or regulatory environment.

• Administer the enterprise security awareness and training program, including annual training, role-based learning, new-hire content, targeted campaigns, and recurring communications.
• Plan and execute periodic phishing simulations with approved scenarios, audience groups, schedules, safeguards, and escalation paths.
• Maintain training assignments, completion records, exceptions, reminders, and evidence required for audits and regulatory reviews.
• Analyze training and phishing results, identify trends and higher-risk populations, and coordinate appropriate coaching, follow-up learning, and corrective actions.
• Develop program communications, metrics, and leadership reporting; evaluate content and platform effectiveness and recommend enhancements that strengthen security culture.

• Adheres to all company policies, procedures, and business ethics codes.
• Completes required regulatory training as assigned.
• Maintains strict adherence to and compliance with all laws, rules, regulations, and internal controls specific to the role, including but not limited to Bank Secrecy Act, Anti-Money Laundering, USA Patriot Act, Office of Foreign Assets Control, and Fair Lending regulations.

This is an intermediate-level role and requires a competent level of knowledge, skill, and ability.

• Competent knowledge of cybersecurity governance, risk, compliance, audit, and control concepts.
• Knowledge of audit evidence practices, issue remediation, control testing, records management, policy governance, and document lifecycle management.
• Knowledge of cybersecurity and financial-services frameworks and requirements, such as the National Institute of Standards and Technology Cybersecurity Framework, National Credit Union Administration guidance, Gramm-Leach-Bliley Act, Federal Financial Institutions Examination Council guidance, and Payment Card Industry Data Security Standard.
• Familiarity with security awareness principles, adult learning concepts, phishing simulation practices, and security culture measurement.

• Project coordination skills, including planning, scheduling, dependency management, action tracking, status reporting, and meeting facilitation.
• Clear business and technical writing skills for developing processes, procedures, control narratives, audit responses, presentations, and program communications.
• Information organization and records-management skills, including taxonomy, version control, document ownership, review cycles, retention, and access management.
• Data analysis and reporting skills using Microsoft Excel, Power BI, or similar tools to develop meaningful metrics and dashboards.
• Proficiency with Microsoft 365 collaboration tools and experience administering governance, risk, compliance, audit, knowledge-management, or security-awareness platforms.

• Ability to manage multiple concurrent requests, deadlines, and stakeholders while maintaining attention to detail and accurate records.
• Ability to translate cybersecurity, audit, and compliance requirements into practical activities and clear communications.
• Ability to build cooperative relationships and influence control owners and cross-functional partners without direct authority.
• Ability to handle confidential or sensitive information with discretion and apply sound judgment when escalating risks or delays.
• Ability to identify process gaps, recommend improvements, and follow work through to measurable completion.

• Puts themselves in the Member’s shoes
• Looks for friction points
• Makes it personalized and easy

• Sets standards for elevating excellence
• Ensures elevated quality
• Takes responsibility
• Conducts continuous improvement

• Challenges current thinking
• Approaches change with a positive mindset

• Bachelor’s degree in cybersecurity, information systems, business, risk management, communications, or a related field, or equivalent relevant professional experience.
• 0-2 years of relevant experience in cybersecurity, governance, risk, compliance, IT audit, information security, records management, training coordination, or a related field.
• Experience developing or maintaining business or technical processes, procedures, standards, training content, or program communications.
• Must be bondable.

• Experience in financial services, fintech, credit unions, or another regulated industry.
• 2 or more years of relevant experience in cybersecurity, governance, risk, compliance, IT audit, information security, records management, training coordination, or a related field.
• Master’s degree in cybersecurity, information systems, business, risk management, communications, or a related field, or equivalent relevant professional experience.
• Experience supporting Information Security audits, regulatory examinations, control assessments, or issue-remediation programs.
• Experience administering a security awareness training or phishing simulation platform.
• Experience with governance, risk, and compliance platforms; document-management systems; Microsoft SharePoint; Power BI; or similar tooling.
• Relevant certification or progress toward certification, such as Certified in Cybersecurity, Security+, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, or Certified Information Security Manager.

The physical demands described are representative of those that must be met by an employee, with or without accommodation, to successfully perform the essential functions of this job. Reasonable accommodation may be made to enable individuals with disabilities to perform the essential functions.

• While performing the duties of this job, the employee is regularly required to sit; use hands to finger, handle or feel; reach with hands and arms; and talk or hear.
• Specific vision abilities required by this job include close vision, distance vision, peripheral vision, and ability to adjust focus.
• Employee will make extensive use of the telephone and virtual communications requiring the ability to explain complex information effectively and accurately.

The work environment characteristics described are representative of those an employee encounters while performing the essential functions of this job.

• This position is hybrid, requiring working onsite at UFCU Plaza in Austin, Texas approximately two days per week, with the remaining days worked remotely.
• This position may involve periodic stressful conditions.
• May occasionally require an adjusted work schedule, overtime, and evening or weekend hours.
• May occasionally move from one work location or branch to another.
• Public contact position, requiring appropriate professional appearance.
• Frequent computer use at a workstation of up to two hours at a time.
• The noise level in the work environment is usually moderate.

#INDUFCU