Information Security Associate

POSITION SUMMARY

KKR is seeking an Information Security Risk Analyst to join the Information Security Governance, Risk, and Compliance (GRC) team. The role will help build and operate cyber and technology governance processes, identify and document risk issues, support remediation strategies, and manage cyber regulatory initiatives. The successful candidate will work across Information Security, Technology, and control functions to strengthen governance, improve risk visibility, support security assessments, and enhance cyber risk reporting.

RESPONSIBILITIES

Cyber Risk & Issue Management

• Support the identification, assessment, documentation, and management of cyber and technology risk issues and develop appropriate remediation, mitigation, and risk management strategies..
• Monitor risk issues and remediation activities, helping ensure risks are appropriately governed through their lifecycle.
• Maintain and support workflows to help ensure cyber risk and exception processes operate consistently and effectively.

Cyber Governance & Control Frameworks

• Help develop and enhance cyber and technology governance frameworks, standards, procedures, and supporting documentation.
• Support the development and maintenance of a cyber control catalog and associated control documentation.
• Support improvements to governance tooling, workflow design, and documentation.

Security & Technology Risk Assessments

• Support security risk assessments of applications, systems, technologies, and technology changes.
• Participate in application security and system design assessments to identify security risks and control requirements.
• Collaborate with technical and business stakeholders to understand system designs, identify risks, and recommend proportionate security controls.

Cyber Regulatory & Compliance Initiatives

• Support the delivery and coordination of cyber regulatory initiatives in response to new and changing regulatory requirements.
• Help assess regulatory requirements and translate them into practical governance, risk, and control activities.
• Help ensure cyber governance processes remain aligned with applicable regulatory obligations and industry frameworks.

Cyber Metrics & Reporting

• Support the development and enhancement of cyber risk metrics, management information, dashboards, and reporting.
• Analyze risk and governance data to identify trends, themes, and areas requiring management attention.
• Help communicate cyber risk information clearly to technical, business, management, and control stakeholders.

QUALIFICATIONS

• Bachelor's degree in Information Security, Information Systems, Computer Science, Risk Management, or a related field—or equivalent work experience.
• Cybersecurity certification would be advantageous, such as CISSP, CompTIA Security+, or an equivalent industry-recognized certification(s).

PREFERRED EXPERIENCE

• Experience working within Information Security, Technology Risk, GRC, Internal Controls, or a related technology governance function.
• Experience identifying, documenting, assessing, and tracking cyber or technology risk issues through remediation or formal risk acceptance.
• Exposure to cyber governance frameworks, standards, and control models such as NIST or CIS as well as regulatory frameworks like SOX or NIS 2.
• Experience supporting the development or maintenance of cyber policies, standards, procedures, control catalogs, or governance documentation.
• Exposure to application security assessments, system design reviews, product security reviews, or broader technology risk assessments.
• Experience developing or contributing to cyber risk metrics, dashboards, management reporting, or other risk-based management information.
• Familiarity with GRC platforms, workflow or ticketing tools, risk registers, reporting tools, or data analysis platforms used to support governance and risk processes.

SOFT SKILL REQUIREMENTS

• Ability to translate complex security, risk, and regulatory topics into clear, practical, and business-friendly guidance/actions.
• Strong stakeholder management skills with the ability to build effective relationships across Information Security, Technology, business, risk, compliance, and other control functions.
• Collaborative and team-oriented, with a willingness to contribute across a global team and work effectively with colleagues from different disciplines and backgrounds.
• Self-motivated with a strong sense of ownership, initiative, and accountability for the quality of work delivered.
• Comfortable operating in areas of ambiguity and adapting to changing priorities, technologies, regulatory expectations, and business needs.

#LI-ONSITE