Risk & Compliance Analyst Risk Register Management

Client of Salt

You will be responsible for maintaining the enterprise Risk Register as the central source of truth for cybersecurity risk management across the organisation.

Working closely with Security Operations, Engineering, Audit, Vulnerability Management, and business stakeholders, you will coordinate risk assessments, track treatment plans, maintain risk ownership, and provide executive-level risk reporting and governance support.

This role is critical in ensuring that security findings from vulnerability management, penetration testing, incidents, audits, and exception processes are translated into a coherent and actionable enterprise risk picture.

Key Responsibilities:

• Maintain and manage the enterprise Risk Register as the authoritative source for cybersecurity risks
• Facilitate risk identification workshops with both technical and business stakeholders
• Document risks using structured and consistent methodologies across threat, vulnerability, asset, and business impact dimensions
• Assess and score inherent and residual risks using agreed enterprise risk methodologies
• Track risk acceptance decisions, treatment plans, mitigation progress, and review timelines
• Ensure every material risk has an accountable owner and defined remediation strategy
• Coordinate periodic risk reviews and governance activities across stakeholders
• Map risks against:
• NIST CSF 2.0
• ISO 27001 controls
• UAE IA requirements
• NIST RMF practices
• Produce executive-level reporting including:
• Risk heatmaps
• Trend analysis
• Governance dashboards
• Risk posture reporting
• Integrate risk inputs from:
• Vulnerability Management
• Penetration testing
• Audit findings
• Security incidents
• Exception management processes
• Support audit readiness and evidence management activities