Staff Security Risk Analyst

We are looking for a Staff Security Risk Analyst to join our team. As a Staff Security Risk Analyst, you will identify, assess, monitor, and report on operational, security, and compliance risks.

Responsibilities:

• Identify, assess, monitor, and report on operational, security, and compliance risks.
• Drive technical automation across the risk management lifecycle by engineering custom AI agents, capabilities, and workflows to optimize risk data processing and scale operations.
• Evaluate security control effectiveness, track deficiencies, and drive engineering remediation activities to closure.
• Conduct root cause analysis on control deficiencies and post-incident reviews to identify underlying gaps and prevent recurrence.
• Partner with risk owners to develop mitigation plans in line with the risk management strategy.
• Govern the formal risk acceptance and exception process.
• Manage the risk register and issue lifecycle to deliver dynamic risk visibility to leadership.
• Apply industry best practices for risk management across Okta, and provide insight into applying regulatory and industry frameworks to Okta's security posture.
• Build strong partnerships with cross-functional teams to foster a cohesive view of security, compliance, and operational risks and drive remediation to closure.
• Serve as a security and technology subject matter expert within the security organization; provide critical advisory in the design and adoption of security controls, particularly those intended to meet regulatory requirements.
• Develop data analytics workflows and establish KRIs and KPIs to elevate team metrics and executive reporting.
• Develop, maintain, and continuously refine standardized risk assessment methodologies, playbooks, and procedures.
• Drive security risk management program maturity and execution, aligning risk governance with the company's goals and security strategy.
• Drive risk-awareness initiatives and champion a security-minded risk culture across business units.
• Support ad hoc projects including program enhancements, security initiatives, and other GRC functions.

Requirements:

• Relevant BA/BS degree.
• 7+ years of hands-on security risk management and technical experience.
• Hands-on experience building automated workflows, scripts (Python/APIs), and AI agentic solutions.
• Industry certification in security (CRISC, CISA, CISM, CISSP) or equivalent certification.
• Experience across regulations and common industry frameworks including but not limited to ISO, PCI, NIST CSF, COSO, and others.
• Preferred experience in Third-Party Risk Management, including hands-on execution of vendor security assessments and overall program operations.
• Track record of effectively influencing technical and business stakeholders to drive risk remediation and process adoption.
• Strong knowledge of agile tools and GRC solutions.
• Excellent verbal, written, and interpersonal skills.
• Ability to manage multiple priority initiatives and deliver results under tight timelines.
• Comfortable with ambiguity and adaptable to fast-changing environments.

Benefits:

• Health, dental, and vision insurance
• RRSP with a match
• Healthcare spending
• Telemedicine
• Paid leave (including PTO and parental leave)