Cyber Risk Analyst

POSITION SUMMARY

Zoetis, Inc. is the world's largest producer of medicine and vaccinations for pets and livestock. The Zoetis Tech & Digital (ZTD) Global Technology Risk Management (TRM) Organizationis responsible forprotecting Zoetis' information resources. Within TRM, the global Identity, Directory & Access Management (IDAM) organization ensures that the right people have the right access to the right information.

TheCyberRiskAnalystis responsible foroverseeing the organization's vulnerability management program, focusing on IT infrastructure, endpoints, networks, and cloud environments. This role ensures proactive identification, analysis, prioritization, and remediation of technical vulnerabilities while embedding risk management practices to minimize security threats and support complianceobjectives. Additionally, theCyberRiskAnalystwill help track enterprise security risk by monitoring risk metrics,maintainingrisk registers, and providing regular updates to leadership, enabling informed decision-making and a holistic understanding of the organization's security posture.

POSITIONRESPONSIBILITIES

• Own the enterprise cybersecurity risk register, taxonomy, and exception workflows with clear escalation thresholds.

• Define and track KRIs/KPIs (e.g., residual risk, SLA compliance, control effectiveness); deliver executive dashboards and briefings.

• Ensure asset and telemetry data quality and coverage; standardize with a Common Information Model (CIM).

• Drive prioritized remediation roadmaps; enforce SLAs with automated reminders and escalations; verify fixes via retest.

• Integrate post-incident lessons into the risk register and backlog;validatecontrols through purple-team exercises.

• Include thirdparty/vendor and application security findings for a holistic enterprise risk view.

• Map risks to policies and regulatory frameworks (NIST, ISO 27001, PCI-DSS, HIPAA); support audits and evidence collection.

• Continuously improve VM processes, tooling, and control designs; measure the efficacy of controls and exceptions.

• Be hands-on: query/validatedata, build metrics/dashboards, and translate technical issues into clear risk treatment plans.

• Engage stakeholders to drive decisions and timelines; tie outcomes to OKRs focused on risk reduction and faster decision cycles.

EDUCATION AND EXPERIENCE

Education:

• Bachelor's degree in computer sciences, Information Security, Information Systems, Engineering,Sciencesor relevant professional experience.

Experience:

• 5+ years of hands-on experience in vulnerability management, cyber risk, or related roles within enterprise IT environments.

TECHNICAL SKILLS REQUIREMENTS

• Proficiencywith vulnerability scanning and security testing tools (e.g., Tenable, Qualys, Rapid7, Falcon Spotlight,AppScan) and using results to improve security operations.

• Experience across infrastructure systems, endpoints, network devices, and cloud platforms (AWS, Azure, Microsoft 365/O365).

• Ability to interpret, prioritize, and report technical risk from vulnerability data using analytics and data visualization tools (e.g., Power BI, Tableau).

• Working knowledge and practical application of security frameworks and compliance requirements (e.g., NIST, PCI-DSS, HIPAA, ISO 27001).

• Experience coordinating remediation across technical and business teams, managing SLAs, and improving remediation processes.

• Understanding ofvulnerability assessments, security policy development, enterprise security strategy, architecture concepts, and governance practices.

• Broad understanding of security technologies, core security principles, control frameworks, and risk considerations for both on-prem and cloud solutions; familiarity with threat modeling concepts.

• Ability to research vulnerabilities and exploit techniques and translate findings into operational improvements.

• Hands-on capability to troubleshoot complex issues and implement solutions in enterprise environments.

• Strong project management skills withabilityto manage multiple priorities in fast-paced operational environments.

• Strong written/verbal communication skills; ability to present clearly, negotiate effectively, and influence stakeholders across levels; able to work independently and in teams.

• High standardsof ethics, professionalism, and integrity.

• Experience in regulated industries (e.g.,pharmaceuticals) is desirable.

• Ability to articulate business-focused security outcomes that guide service direction and improve security posture.

PHYSICALPOSITIONREQUIREMENTS

• Primarily office-based workinvolvingsitting, computer use, and meetings.

• Ability to work flexible hours as needed to coordinate with global teams and support audit readiness activities.

• Occasional travel may berequiredfor audits, regulatory meetings, orintegrationactivities.

• No unusual physical demands or attendance requirementsexpected.

Travel Requirements: 5%-10%

Any unsolicited resumes sent to Zoetis from a third party, such as an Agency recruiter, including unsolicited resumes sent to a Zoetis mailing address, fax machine or email address, directly to Zoetis employees, or to Zoetis resume database will be considered Zoetis property. Zoetis will NOT pay a fee for any placement resulting from the receipt of an unsolicited resume.

Zoetis will consider any candidate for whom an Agency has submitted an unsolicited resume to have been referred by the Agency free of any charges or fees. This includes any Agency that is an approved/engaged vendor but does not have the appropriate approvals to be engaged on a search.

Notice: Zoetis Recruiters will contact candidates via email from an address ending in @zoetis.com and may also initially connect with candidates through LinkedIn, including LinkedIn InMail. Zoetis does not use Gmail, Outlook, Yahoo, or other web-based/generic email domains to communicate about job opportunities, interviews, or offers of employment. If you receive a recruitment-related email message claiming to be from Zoetis that does not come from @zoetis.com, please treat it as suspicious. For your security, do not reply, click links, open attachments, share personal or financial information, or send money in response to unexpected or questionable recruitment communications.