# Security Risk Analyst

> Guides information security risk analysis—risk identification and scoring, risk registers, threat/vulnerability/control mapping, treatment recommendations (accept/mitigate/transfer/avoid), third-party and supply-chain risk framing, business impact analysis, KRIs, and risk committee or board narratives. Aligns with ISO 27005 and NIST RMF concepts without full compliance audits. Use for security risk assessment, risk register maintenance, inherent/residual risk scoring, FAIR-style quantitative framing, treatment decisions, third-party risk tiers, or executive risk reporting—not SOC alert triage (soc-analyst), pentest execution (penetration-tester, web-pentester, network-pentester), control implementation (information-security-engineer, cloud-security-engineer), GRC program and audit prep (compliance-specialist), audit evidence automation (compliance-engineer, cloud-compliance-specialist), AI model risk programs (ai-risk-governance), or adversary simulation (red-team-specialist).

- Skill: `daemon-blockint-tech/security-risk-analyst` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add daemon-blockint-tech/security-risk-analyst`
- Raw SKILL.md: https://api.skillmd.com/api/skills/daemon-blockint-tech/security-risk-analyst/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: daemon-blockint-tech (https://skillmd.com/u/daemon-blockint-tech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/daemon-blockint-tech/security-risk-analyst

---


# Security Risk Analyst

## When to Use

- Build or refresh an **information security risk register** with owners and review cadence
- Score **inherent and residual risk** (likelihood × impact or FAIR-style loss estimates)
- Map **threats, vulnerabilities, and controls** to risk scenarios and control gaps
- Recommend **treatment** (accept, mitigate, transfer, avoid) with business justification
- Frame **third-party and supply-chain** risk tiers, questionnaires, and concentration
- Prepare **business impact analysis** inputs and **KRIs** for security risk committees
- Draft **executive or board risk narratives** (heat maps, top risks, trend, appetite)

## When NOT to Use

- Triage SIEM/EDR alerts or SOC playbooks → `soc-analyst`
- Execute authorized pentests or exploitation → `penetration-tester`, `web-pentester`, `network-pentester`
- Implement IAM, encryption, SIEM, or cloud guardrails → `information-security-engineer`, `cloud-security-engineer`
- IAM entitlement design, access reviews, SoD matrices → `iam-specialist`
- GRC program, framework scope, audit coordination → `compliance-specialist`
- Automate SOC 2/ISO evidence and control attestation → `compliance-engineer`, `cloud-compliance-specialist`
- Define enterprise security strategy or IR program → `cybersecurity`
- Classify AI use cases and model governance → `ai-risk-governance`
- Plan adversary simulation campaigns → `red-team-specialist`
- Threat actor/campaign intel production → `cti-analyst`

## Related skills

| Need | Skill |
|---|---|
| Implement controls from risk treatment | `information-security-engineer` |
| IAM risk scenarios, SoD, access governance | `iam-specialist` |
| Cloud guardrails and CSPM remediation | `cloud-security-engineer` |
| GRC program, gap plans, audit prep | `compliance-specialist` |
| Audit evidence and framework mapping | `compliance-engineer` |
| Cloud-only compliance evidence | `cloud-compliance-specialist` |
| Security program, IR, pentest governance | `cybersecurity` |
| AI system risk tiers and model governance | `ai-risk-governance` |
| Sector campaigns, actor trends for threat-informed risk | `cti-analyst` |
| Authorized adversary simulation | `red-team-specialist` |
| SOC alert triage | `soc-analyst` |
| Pentest findings as risk input | `penetration-tester` |
| M&A/investment diligence and IC cyber briefs | `cyber-diligence-governance` |

## Core Workflows

### 1. Risk assessment intake

1. Define **scope** (business unit, system, vendor, program)
2. Identify **assets**, data classes, and dependencies
3. Capture **threat events** and **vulnerabilities** (see references)
4. Document existing **controls** and their effectiveness
5. Score **inherent** risk (before controls) and **residual** (after controls)
6. Compare to **risk appetite** and escalation thresholds

**See `references/risk_identification_and_scoring.md`.**

### 2. Risk register maintenance

Maintain one row per material risk scenario:

| Field | Purpose |
|---|---|
| Risk ID | Stable identifier |
| Scenario | What could go wrong |
| Owner | Accountable business or tech lead |
| Inherent / residual | Scores and rationale |
| Treatment | accept / mitigate / transfer / avoid |
| Target date | For mitigation or acceptance expiry |
| KRI | Measurable indicator |

Review quarterly minimum; re-score on major change, incident, or audit finding.

**See `references/security_risk_analyst_scope.md` for boundaries.**

### 3. Threat–vulnerability–control mapping

```
threat actor/event → vulnerability/condition → impact → existing controls → gap → residual risk
```

Link pentest, vuln scan, audit, and threat intel inputs without duplicating execution work.

**See `references/threat_vulnerability_control_mapping.md`.**

### 4. Treatment and acceptance

For each risk above appetite:

1. Propose treatment option(s) with cost, effort, and residual risk
2. Obtain **risk owner** and **risk committee** decision where required
3. Record **accepted risks** with approver, expiry, and compensating controls
4. Track mitigation tasks to closure; re-score residual on completion

**See `references/treatment_and_acceptance.md`.**

### 5. Third-party and supply-chain risk

Tier vendors by data access, criticality, and concentration. Align questionnaire depth to tier. Feed inherent risk into enterprise register; do not replace legal review.

**See `references/third_party_and_supply_chain_risk.md`.**

### 6. Reporting and governance

Produce committee-ready packs: top risks, heat map, trend, KRIs, treatment status, exceptions nearing expiry. Separate **risk analysis** from **compliance attestation** narratives.

**See `references/reporting_and_governance.md`.**

## When to load references

- **Scope and role boundaries** → `references/security_risk_analyst_scope.md`
- **Scoring scales and FAIR-style framing** → `references/risk_identification_and_scoring.md`
- **TVC mapping and control gaps** → `references/threat_vulnerability_control_mapping.md`
- **Treatment and risk acceptance** → `references/treatment_and_acceptance.md`
- **Vendor and supply chain** → `references/third_party_and_supply_chain_risk.md`
- **KRIs, committees, board narrative** → `references/reporting_and_governance.md`