Cyber Risk Analyst - Senior

Job Description: Cyber Assessment Analyst – Third-Party Risk Management (TPRM)

Client: NiSource
Location: Columbus, OH, or Merrillville, IN
Work Arrangement: Hybrid – onsite 3 days per week

Job Summary

NiSource is seeking a Cyber Assessment Analyst to support and improve its Cyber Assessments and Third-Party Risk Management (TPRM) program. The role focuses on assessing supplier and vendor cybersecurity risks, reviewing security controls, tracking risk issues, and reporting assessment results using Governance, Risk, and Compliance (GRC) tools.

The analyst will work closely with Cybersecurity, IT, OT, Supply Chain, Compliance, Internal Audit, and business teams to evaluate third-party risk profiles, support vendor onboarding and contract renewals, and ensure identified risks are tracked and addressed. The role also supports the use and adoption of Archer GRC and Fortress Control Assessments tools.

Key Responsibilities

• Support the execution and ongoing improvement of the Cyber Assessments and TPRM program.

• Perform or support third-party vendor cybersecurity assessments and control reviews.

• Evaluate supplier risk profiles, identify security gaps, and track risks, exceptions, and remediation activities.

• Collaborate with IT, OT, Cybersecurity, Supply Chain, Compliance, Internal Audit, and business stakeholders.

• Support the implementation of roadmaps for Cyber Assessments, Archer GRC, and Fortress Control Assessments.

• Maintain and improve the use of Archer GRC for risk management, compliance, policy monitoring, and tracking.

• Support vendor risk assessments during supplier onboarding and contract renewal processes.

• Prepare reports, dashboards, metrics, and assessment summaries for management and business stakeholders.

• Ensure assessments follow established methodologies and meet project timelines, budget requirements, and reporting expectations.

• Assist with audit findings, issue tracking, resolution, and process improvement initiatives.

• Support continuous monitoring of third-party risks and communicate assessment results to relevant stakeholders.

• Help expand the adoption of GRC tools across NiSource business units and support integration with systems such as Workday and ServiceNow.

• Apply relevant cybersecurity frameworks and industry best practices, including NIST Cybersecurity Framework (CSF).

Minimum Qualifications

• Bachelor's degree or equivalent work experience.

• 6+ years of experience in Third-Party Risk Management (TPRM).

• 6+ years of experience with vendor control assessments, SOC 2 reports, and metrics.

• In-depth knowledge of TPRM processes, reporting, metrics, trends, and best practices.

• Solid understanding of the NIST Cybersecurity Framework (CSF).

• Experience participating in and successfully delivering TPRM projects.

• Experience contributing to process improvement initiatives.

• Strong analytical, problem-solving, process analysis, and root cause analysis skills.

• Ability to work independently across multiple functional areas with minimal assistance.

• Strong communication, collaboration, negotiation, organizational, and conflict-resolution skills.

• Proficiency with Microsoft Office 365 and the ability to learn new technical concepts quickly.

• Knowledge of gas and electric utility operations; NiSource business operations knowledge is relevant to the role.

Preferred Qualifications

• Experience using the Archer GRC tool.

• Experience with Microsoft Excel and Word.

• Experience with SharePoint.

• Experience in reporting, analytics, dashboard creation, and metrics development.

• Familiarity with vendor cybersecurity risk management and control assessment processes.

Key Success Factors

• Improve the Cyber Assessments program and reduce third-party vendor risks.

• Provide clear and timely risk assessment results to management, Supply Chain, and vendor relationship owners.

• Maintain accurate vendor risk profiles and track exceptions and remediation activities.

• Support effective use of the GRC platform across IT, Supply Chain, Cyber Compliance, and other business units.

• Strengthen continuous monitoring and third-party risk visibility.

• Promote a positive business experience through proactive communication and effective risk management.

Mandatory Requirements

• U.S. Citizen only.

• Must be local to Columbus, OH, or Merrillville, IN.

• Must be available to work onsite 3 days per week.

• 6+ years of TPRM experience.

• 6+ years of vendor control assessment, SOC 2 report, and metrics experience.

• Solid understanding of the NIST Cybersecurity Framework (CSF).