Cyber risk analyst

What does a cyber risk analyst do?

A cyber risk analyst finds and rates technology risks, then recommends controls to reduce them.

The work covers new projects, vendors and systems already in use. Findings go into written assessments that managers use to decide what to fix first.

The role usually sits in a technology risk, information security or governance, risk and compliance (GRC) team. You find it in banks, insurers, government agencies, healthcare groups and large firms that run regulated systems.

You work with security engineers, IT teams, project managers, internal audit, compliance staff and vendors. In financial institutions, your assessments also support the organisation's response to Monetary Authority of Singapore (MAS) expectations.

What the work involves

• Assess the cyber risk of a new system or project before it goes live, and agree the scope with the project team.
• Review security controls at vendors and in internal systems, and record gaps in a risk register.
• Track fixes for audit and security findings, and chase owners when deadlines slip.
• Write risk assessment reports and short threat updates for managers and committees.
• Review security policies and standards, and log requests for exceptions with their risk rating.
• Look into the cause of a security incident and suggest steps to stop it happening again.

Pay in Singapore

Back to top

Skills a cyber risk analyst needs

Back to top

Cyber risk analyst job description

We are hiring a cyber risk analyst to assess technology risks and help the business manage them.

You will review projects, vendors and systems, rate the risks, recommend controls and track fixes. You will work with IT, security, audit and compliance teams, and write clear reports for senior managers. The role suits someone who can explain technical issues in simple language.

Responsibilities

• Run cyber risk assessments for new technology projects and changes to existing systems.
• Define the scope of each assessment and gather evidence from system owners.
• Assess the security controls of third-party vendors and internal platforms.
• Maintain the risk register and record agreed controls, owners and deadlines.
• Track remediation of audit and security findings until they are closed.
• Review security policies, standards and exception requests against agreed frameworks.
• Write cyber risk reports and threat awareness updates for managers.
• Research new threats, alerts and regulatory changes, and flag those that affect the organisation.
• Support the analysis of security incidents and propose preventive measures.
• Help prepare for internal audits, external audits and regulator reviews.

Requirements

• Diploma or degree in information technology, cybersecurity, computer science, information systems or a related field.
• Typically 2 to 4 years in security, IT audit, GRC or IT operations. Some employers hire graduates for junior analyst posts.
• Working knowledge of ISO 27001 and the NIST frameworks. Financial employers often expect familiarity with the MAS Technology Risk Management Guidelines.
• Ability to read vendor security documents, penetration test reports and audit findings.
• Good Excel skills for risk registers and tracking, plus clear written English for reports.
• Certifications such as CISA, CISM, CRISC or ISO 27001 Lead Implementer are often preferred but not always required.

Back to top

Cyber risk analyst career path

Most cyber risk analysts start in security operations, IT audit or GRC support, then move into senior analysis and risk management.

Titles vary by employer, so the steps below are a common pattern.

1. Junior security or GRC analyst

   Entry

   You support assessments, update risk registers and collect evidence from system owners under guidance.

2. Cyber risk analyst

   Mid · SkillsFuture title

   You run risk assessments on your own, review vendor and internal controls, write reports and track remediation.

3. Senior cyber risk analyst

   Senior

   You handle complex or high-risk projects, guide junior staff and advise project teams on controls.

4. Cyber risk manager

   Lead

   You lead the risk team, set assessment methods and report risk positions to senior management and committees.

5. Head of technology or cyber risk

   Head

   You own the cyber risk approach for the organisation and answer to the board and regulators on it.

Steps marked "SkillsFuture title" follow the career pathway in the SkillsFuture Skills Framework. The others are titles commonly used in Singapore.

Related jobs and their pay

Back to top

Cyber risk analyst interview questions

We wrote these questions from the skills this job needs. They are not an official question bank.

1. How would you carry out a cyber risk assessment for a new customer-facing web application?

   What a good answer covers

   • Starts by agreeing the scope, assets, data types and owners
   • Identifies threats and weaknesses, for example from architecture reviews and test reports
   • Rates likelihood and impact using a defined scale
   • Recommends controls and records residual risk and owners
   • Documents the result in a report the project team can act on

2. What is the difference between ISO 27001 and the NIST Cybersecurity Framework, and when would you use each?

   What a good answer covers

   • ISO 27001 is a certifiable standard for an information security management system
   • NIST CSF is a flexible set of outcomes: identify, protect, detect, respond, recover
   • Explains that organisations often map one to the other
   • Gives an example, such as using ISO 27001 for certification and NIST to compare maturity

3. How do you rate a risk when likelihood is hard to estimate?

   What a good answer covers

   • Uses past incidents, threat intelligence and control strength as inputs
   • Applies a consistent scale and records the reasoning
   • Considers qualitative and simple quantitative methods
   • Reviews the rating with the system owner and security team
   • Revisits the rating when conditions change

4. How would you use threat intelligence in a risk assessment?

   What a good answer covers

   • Picks sources relevant to the sector and technology in use
   • Links threats to specific assets and weaknesses
   • Separates useful alerts from general noise
   • Updates risk ratings and tells owners what changed
   • Summarises the threat picture without jargon for managers

5. What would you check when assessing the security controls of a cloud software vendor?

   What a good answer covers

   • Asks for independent assurance reports and certifications
   • Reviews access control, encryption, logging and incident notification terms
   • Checks where data is stored and who can access it
   • Looks at subcontractors and exit arrangements
   • Records gaps, agreed fixes and a follow-up date

6. How do you keep a risk register and remediation tracker useful rather than a list nobody reads?

   What a good answer covers

   • Gives every item an owner, rating, due date and status
   • Uses Excel filters, pivot tables or formulas to show overdue and high-rated items
   • Reports ageing and trends, not only counts
   • Closes items only after evidence is checked
   • Agrees a regular review with owners

7. A Critical Information Infrastructure owner must follow the CSA Cybersecurity Code of Practice. How would you use it in your assessments?

   What a good answer covers

   • Explains that the Code sets minimum protection requirements for owners designated under the Cybersecurity Act
   • Maps assessment findings to relevant Code requirements
   • Checks that gaps are tracked and escalated
   • Notes that scope depends on whether the system is designated
   • Says you would confirm the current version with compliance or legal

1. A project team wants to go live next week, but your assessment found a high-rated gap in access control. What do you do?

   What a good answer covers

   • Explains the risk in business terms to the project manager and system owner
   • Offers options such as a fix, a temporary control or a time-limited exception
   • Escalates to the approver for risk acceptance if the gap stays
   • Records the decision, owner and expiry date
   • Keeps the rating honest even when the deadline is tight

2. An internal audit finding on weak vendor oversight is six months overdue. How do you get it closed?

   What a good answer covers

   • Finds out why it is stuck: resources, unclear ownership or technical blockers
   • Agrees a realistic plan with the owner and a new date
   • Escalates to the owner's manager if there is no progress
   • Suggests interim controls to reduce the risk meanwhile
   • Keeps evidence for the auditors

3. A staff member used a public AI chatbot such as ChatGPT to summarise a customer contract. How do you assess the risk?

   What a good answer covers

   • Identifies what data was entered and whether it was confidential or personal
   • Checks company policy on approved tools
   • Considers contract, regulatory and reputational impact
   • Recommends clear guidance, approved tools or technical controls
   • Suggests awareness training for staff

1. Tell us about a time you had to explain a technical risk to a non-technical manager.

   What a good answer covers

   • Describes the audience and what they needed to decide
   • Used simple language and a clear business impact
   • Gave options with a recommendation
   • Explains the outcome and what you would change next time

2. Describe a time you disagreed with a system owner about a risk rating. How did you handle it?

   What a good answer covers

   • Listened to their reasoning and checked the evidence
   • Stayed factual and kept the rating criteria consistent
   • Involved a senior colleague if needed
   • Reached a documented outcome and kept the relationship intact

1. A bank plans to move a customer system to the cloud. How would you reflect the MAS Technology Risk Management Guidelines in your assessment?

   What a good answer covers

   • Says the guidelines set MAS expectations for technology risk governance and controls
   • Reviews areas such as cloud governance, access control, resilience and third-party oversight
   • Maps gaps to the bank's own policies and standards
   • Involves compliance and the outsourcing risk team
   • Says you would check the latest MAS guidance before finalising

2. A vendor breach may have exposed customers' personal data. What is your role in assessing it under the PDPA?

   What a good answer covers

   • Helps establish what data was involved and how many people are affected
   • Supports the assessment of whether significant harm is likely or the scale is significant
   • Passes the findings quickly to the data protection officer and incident team
   • Notes that notification timelines and thresholds come from the PDPA and Personal Data Protection Commission guidance
   • Records the cause and preventive actions

Common questions about a cyber risk analyst job

Sources