Cybersecurity Analyst - Risk and Controls

The ER&R Risk Analyst role at Sherwin-Williams is focused on finding, evaluating, and communicating enterprise cybersecurity risk through IT risk assessments. Working across ER&R and Enterprise Technology, you will help prioritize risk, support mitigation planning, and maintain the documentation and policy work needed to strengthen the organization’s cybersecurity posture.

Based in Cleveland, OH (remote), this position supports risk identification across internal and external environments, including privacy and data security considerations tied to business processes, applications, and vendors.

Key Responsibilities

• Partner with ER&R and Enterprise Technology teams to identify and contain internal and external risks.
• Develop an in-depth understanding of business processes, applications, standard programs, and reports as they relate to privacy and data security.
• Lead analysis of complex business processes or issues, quickly connecting business needs with privacy and data challenges.
• Conduct risk assessments for new and existing technologies, data processing activities, policy exceptions, and non-compliant third-party vendors.
• Spot process improvement opportunities, define improvement requirements, perform detailed analysis, and act as a liaison between business stakeholders and development resources; support communication and training for process changes.
• Collaborate with business owners to develop and monitor risk mitigation efforts, ensuring issues are tracked, reported, and resolved on a timely basis.
• Communicate with data owners to understand needs and evaluate business solutions.
• Work closely with key business personnel across divisions, including domestic and global teams.
• Demonstrate ownership and accountability for continuous improvement.
• Create informative, well-organized presentations and communicate sensitive topics tactfully.
• Apply knowledge of emerging privacy and security laws and best practices to solve business problems.
• Lead the development and implementation of cybersecurity policy, standards, and procedures aligned to the organization’s framework, best practices, and objectives.
• Work with IT and security teams to help enforce cybersecurity policies and procedures.
• Practice creative thinking beyond existing company practices and mindsets.
• Facilitate effective team interaction and recognize each team member’s contributions.
• Seek and participate in development opportunities beyond required training.
• Complete special projects as requested.

Required Qualifications

• Bachelor’s Degree (or foreign equivalent). In lieu of a degree, at least 12 years of experience in the field of Information Technology or Business, or a combination of education and experience in IT or Business.
• 2+ years in IT and/or Business with experience assessing and evaluating business risk.
• Leadership, problem solving, critical thinking, decision-making, organizational skills, strong oral and written communication, and the ability to work independently.
• Intermediate knowledge of Microsoft Office tools.
• Experience working on collaborative teams and motivating others in a team-oriented environment across cultures.
• Business knowledge including a working knowledge of SW structure, business processes, operations, and goals (preferred).
• Ability to score, calculate, and quantify risk.
• Experience with internal control frameworks for IT, information security, IT governance frameworks, and conducting and analyzing risk assessments.
• Excellent writing and communication skills, including translating technical concepts into clear, concise policy and standards.
• Must be legally authorized to work in the United States without company sponsorship.
• Must be at least 18 years of age.

Technologies and Frameworks

• Microsoft Office
• CISSP, CISA, CRISC
• FAIR
• NIST Cyber Security Framework (CSF)
• NIST Privacy Framework (PF)
• AI Framework

Preferred

• Experience with IT GRC or an equivalent risk or security management system.
• Preferred certifications: CISSP, CISA, CRISC, FAIR, or related certifications.
• Knowledge of NIST frameworks including CSF and PF, plus the AI Framework.

Compensation: USD 82,208 - 104,290 per year.

Minimum Experience: 2 years.