Analyst - Business Risk Controls Management

The Application Risk Assessment team serves as the first line of risk defense for the organization’s application landscape. The team works closely with engineering and product teams to identify, assess, and reduce security risks early in the application lifecycle. By applying structured methodologies aligned with frameworks such as NIST CSF and ISO 27001, the team ensures applications are designed and operated with strong security controls. This role places you at the intersection of technology and risk, where your assessments directly influence design decisions, strengthen security posture, and enable safe and reliable product delivery.

Key Responsibilities and Duties Perform application risk assessments using defined frameworks.

Validate security controls across various application control programs.

Identify risks in enterprise applications, rate severity, and document findings based on the assessments.

Track remediation actions and follow up with application owners.

Support risk evaluations.

Maintain accurate records in GRC tools.

Contribute to playbooks, templates, and process improvements.

Educational Requirements Vocational and/or Technical Education Preferred Work Experience 3+ Years Required; 5+ Years Preferred Physical Requirements Physical Requirements: Sedentary Work

Career Level 4IC

Expectations  Deliver assessment results on time with clear documentation.  Communicate risks in simple, business friendly language.  Show ownership of assigned application related tasks.  Ask the right questions when requirements are unclear.  Continuously improve technical and risk knowledge.  Maintain confidentiality and data handling discipline.  Non-Negotiables  Strong integrity and ethical judgment.  Adherence to defined assessment methodology.  Clear and timely communication of risks.  Willingness to learn core security concepts within the first 90 days.  Required Skills  1+ years of experience in cybersecurity, risk, or application support.  Basic understanding of web applications and APIs.  Knowledge of common vulnerabilities such as those in OWASP Top 10.  Familiarity with authentication and access control concepts.  Ability to read and understand technical documentation.  Strong analytical and problem-solving ability.  Good written and verbal communication.  Working knowledge of Excel and documentation tools.  Preferred Skills  Exposure to secure SDLC practices.  Understanding of cloud basics in AWS, Azure, or GCP.  Familiarity with risk frameworks like NIST CSF 2.0 or ISO 27001.  Experience with any GRC tool.  Internship or project experience in cybersecurity. 

Related Skills

Business Acumen, Business Process Improvement, Business Process Understanding, Communication, Compliance, Continuous Improvement Mindset, Detail-Oriented, General Risk Management, Influence, Relationship Management, Risk Mitigation, Risk Monitoring _____________________________________________________________________________________________________

Company Overview TIAA Global Capabilities was established in 2016 with a mission to tap into a vast pool of talent, reduce risk by insourcing key platforms and processes, as well as contribute to innovation with a focus on enhancing our technology stack. TIAA Global Capabilities is focused on building a scalable and sustainable organization , with a focus on technology , operations and expanding into the shared services business space.   Working closely with our U.S. colleagues and other partners, our goal is to reduce risk, improve the efficiency of our technology and processes and develop innovative ideas to increase throughput and productivity.

We are an Equal Opportunity Employer. TIAA does not discriminate against any candidate or employee on the basis of age, race, color, national origin, sex, religion, veteran status, disability, sexual orientation, gender identity, or any other legally protected status.

Our Culture of Impact At TIAA, we're on a mission to build on our 100+ year legacy of delivering for our clients while evolving to meet tomorrow's challenges. We equip our associates with future-focused skills and AI tools that enable us to advance our mission. Together, we are fighting to ensure a more secure financial future for all and for generations to come. We are guided by our values: Champion Our People, Be Client Obsessed, Lead with Integrity, Own It, and Win As One. They influence every decision we make and how we work together to serve our clients every day. We thrive in a collaborative in-office environment where teams work across organizational boundaries with shared purpose, accelerating innovation and delivering meaningful results. Our workplace brings together TIAA and Nuveen's entrepreneurial spirit, where we work hard and work together to create lasting impact. Here, every associate can grow through meaningful learning experiences and development pathways—because when our people succeed, our impact on clients' lives grows stronger.

Accessibility Support TIAA offers support for those who need assistance with our online application process to provide an equal employment opportunity to all job seekers, including individuals with disabilities.

If you are a U.S. applicant and desire a reasonable accommodation to complete a job application please use one of the below options to contact our accessibility support team: 

Phone: (800) 842-2755 Email: accessibility.support@tiaa.org

Privacy Notices For Applicants of TIAA, Nuveen and Affiliates residing in US (other than California), click here .

For Applicants of TIAA, Nuveen and Affiliates residing in California, please click here .

For Applicants of TIAA Global Capabilities, click here .

For Applicants of Nuveen residing in Europe and APAC, please click here .