Cybersecurity Risk Analyst – IT/OT Security

About the role

The Cybersecurity Risk Analyst will identify, assess, and manage cyber risks across CITGO’s IT and OT environments. Working closely with cross‑functional teams, the analyst will design and implement risk‑mitigation strategies, support incident response, and ensure compliance with industry standards.

Key responsibilities

• Conduct comprehensive risk assessments for networks, cloud platforms, IoT devices, and software applications.
• Lead vulnerability scans, penetration tests, and threat‑modeling activities.
• Produce risk reports, communicate findings to stakeholders, and track remediation progress.
• Ensure compliance with regulations such as GDPR, CCPA, and PCI DSS and manage third‑party risk.
• Support incident response, post‑incident analysis, and continuous improvement of security posture.

Required profile

• Bachelor’s degree in a related field.
• Minimum 8 years of experience in cybersecurity risk analysis, vulnerability management, or related roles.
• In‑depth knowledge of NIST, ISO 27001, FAIR, and CIS Controls frameworks.
• Strong analytical and problem‑solving abilities.
• Excellent communication skills to translate technical risks into business impact.

Required skills

• Vulnerability management processes
• Penetration testing
• Threat modeling
• IT and OT environment expertise (cloud platforms, IoT devices, data centers, software applications)
• Regulatory compliance (GDPR, CCPA, PCI DSS)
• NIST framework
• ISO 27001
• FAIR risk analysis methodology
• CIS Controls