Business Analyst - Risk & Vulnerability

Business Analyst - Cybersecurity / Risk and Vulnerability Management

Context and Mandate

We are seeking a Cybersecurity Business Analyst with expertise in risk and vulnerability management to support process improvements, define requirements, and formalize security controls aligned with organizational needs.

The consultant will help teams identify gaps, assess business impacts, and prioritize risk reduction initiatives. They will contribute to establishing structured processes for assessing, treating, and monitoring risks and vulnerabilities, taking business priorities and available budgets into account.

The mandate will also include a component related to generative AI and large language models (LLMs), particularly documenting the risks associated with their use and defining appropriate security controls.

The consultant will work closely with cybersecurity teams, risk and vulnerability management leads, product owners, technical teams, and business stakeholders.

Responsibilities

• Business needs analysis: Gather, analyze, and document business needs related to cybersecurity risk and vulnerability management.
• Process documentation and improvement: Map current processes, identify gaps, and define target processes for identifying, assessing, prioritizing, and treating risks and vulnerabilities.
• Requirements and control definition: Translate security policies and business needs into functional requirements, business rules, and acceptance criteria.
• Risk assessment support: Structure the information needed to assess business impacts, determine risk severity, and document residual risks.
• Vulnerability prioritization: Support the definition of prioritization criteria based on asset criticality, exposure, business impacts, and exploitability.
• Treatment plan tracking: Document corrective actions, accountabilities, timelines, and exception management and escalation mechanisms.
• Metrics and reporting: Help define indicators and dashboards to monitor risk exposure and remediation progress.
• Impact analysis and business cases: Assess the impacts of proposed changes and support the justification of initiatives based on business value, risk reduction, and required effort.
• AI and LLM component: Support risk analysis for AI use cases and document related security requirements, particularly regarding sensitive data, access permissions, and unauthorized actions.
• Stakeholder coordination: Facilitate workshops and decisions, and maintain traceability between business needs, requirements, and deliverables.

Requirements

• Proven experience in business analysis within a cybersecurity environment.
• Strong understanding of technology risk and vulnerability management practices.
• Experience gathering requirements, facilitating workshops, documenting processes, and writing business and functional requirements.
• Ability to translate security issues into actionable requirements and measurable acceptance criteria.
• Understanding of the vulnerability management lifecycle: identification, assessment, prioritization, remediation, and monitoring.
• Ability to assess business impacts and support initiative prioritization.
• Strong collaboration and communication skills, with the ability to explain complex issues to business and technical stakeholders and produce clear, structured deliverables.

Assets

• Experience in banking or another regulated environment.
• Experience with vulnerability management platforms or governance, risk, and compliance (GRC) tools.
• Familiarity with application security, cloud environments, and identity and access management.
• Understanding of security risks associated with generative AI, LLMs, or AI agents.
• Experience defining controls to support the adoption of emerging technologies.
• Familiarity with Agile / SAFe methodologies, Jira, and Confluence.