Job Description
Junior Risk Analyst (GRC) – Entry Level, Full Time (Remote)
Company Summary
Mutual of Omaha is a Fortune 300 Company. Mutual of Omaha Mortgage is inspired by hometown values and a commitment to being responsible and caring for each other. We exist for the benefit of our customers and employees.
Mutual of Omaha Mortgage is a full-service lending company offering both Forward and Reverse Mortgage products including a complete line of residential mortgage, refinancing, specialty, and HECM loans. We employ a knowledgeable staff of experienced Loan Officers with an operations team that is second to none. If you are interested in joining a team that promotes from within and works together toward a common goal of helping customers with their mortgage needs, please review and apply for our opening below!
Role Summary
This is a hands-on, true entry-level Junior Risk Analyst role intended for someone deliberately pursuing a career in Governance, Risk, and Compliance (GRC) within cybersecurity. While little to no prior professional experience is required, candidates must demonstrate foundational GRC knowledge through a relevant degree, internship, certification, or active pursuit of a related degree or certification. Success in this role requires discipline, intellectual curiosity, critical thinking, sound judgment, ownership, and personal accountability.
The Junior Risk Analyst will work under the close mentorship of an experienced Lead Risk Analyst and report to the Cybersecurity Manager. The role provides meaningful exposure to insider risk investigations, eDiscovery, audits, assessments, compliance activities, third-party risk, and risk documentation, with clear expectations for quality, accuracy, follow-through, and continuous growth. Training and guidance will be provided; however, success depends on the ability to learn independently, validate work, ask thoughtful questions, and earn increased responsibility through performance.
This is not a security operations role and is not a passive or “check-the-box” compliance position. Limited cross-training with SecOps will occur to support collaboration and situational awareness, but the primary focus remains GRC and risk management.
Core Responsibilities
Risk Investigations & Case Management
- Assist the Lead Risk Analyst with the investigation and analysis of Insider Risk cases, following defined processes and guidance
- Work assigned risk-related tickets through to completion with oversight from the Lead Risk Analyst and Cybersecurity Manager
- Maintain accurate, defensible documentation of findings, actions taken, and outcomes
- Validate information and evidence prior to escalation or conclusion
eDiscovery & Legal / HR Support
- Support eDiscovery requests from Legal and Human Resources, including data identification, coordination, and documentation
- Assist with evidence handling and response tracking to ensure requests are completed accurately and on time
GRC, Audits & Compliance
- Assist with internal and external risk and control assessments, including responding to auditor and state examiner questions and evidence requests
- Support PCI compliance activities, including annual PCI self-certification requirements and related documentation
- Assist the Lead Risk Analyst with vendor due diligence questionnaires (DDQs) and third-party risk assessments
- Help maintain risk registers, control inventories, and supporting GRC artifacts
Projects & Initiatives
- Heavily assist the Lead Risk Analyst and Cybersecurity Manager with assigned GRC and risk-related project tasks
- Support execution of projects involving risk assessments, control improvements, process enhancements, and compliance initiatives
- Track assigned project tasks to completion, ensuring deliverables are accurate, timely, and well-documented
- Take increasing ownership of defined project workstreams as skills, confidence, and judgment grow
Metrics, Reporting & Leadership Support
- Assist the Lead Risk Analyst with GRC KPI and KRI metrics, including data collection, validation, and analysis
- Support preparation of risk and compliance metrics used in leadership presentations and reporting
- Help ensure metrics are accurate, meaningful, and defensible
Documentation & Process Improvement
- Develop, maintain, and continuously improve risk, compliance, and investigation process documentation, ensuring procedures are accurate, current, and audit-ready
- Assist in improving workflows, documentation standards, and assessment processes
- Take increasing ownership of documentation and process improvement efforts
Collaboration, Meetings & Professional Development
- Attend and actively participate in weekly team meetings, working sessions, and other relevant work-related calls
- Communicate clearly and professionally with internal stakeholders as directed
- Dedicate time to skills development and continuous learning, including frameworks, tooling, and methodologies
- Actively pursue growth toward advanced GRC knowledge and certifications such as GRC Professional (GRCP)
Expectations and Working Style
At all times, the Junior Risk Analyst is expected to:
- Demonstrate discipline, ownership, and pride in work quality
- Validate findings before acting, escalating, or communicating conclusions
- Think critically and avoid assumptions
- Use available resources effectively, including documentation, mentorship, and independent research
- Communicate clearly, accurately, and professionally
- Understand that results, accuracy, and judgment matter more than effort alone
This role is not for someone who dislikes accountability, structure, direction, or being evaluated on outcomes.
Education and Certifications – Read Carefully
Education and certifications alone do not determine success in this role.
Minimum Requirements
- Basic understanding of information security frameworks and GRC concepts
- One year or less of relevant professional experience (or equivalent academic exposure)
- Genuine interest in pursuing a career in cybersecurity risk and GRC
Nice to Have
- Bachelor’s degree (any relevant discipline)
- Entry-level GRC, risk, or compliance certifications
- Interest in pursuing certifications such as GRC Professional (GRCP)
Preference will be given to candidates who can convincingly demonstrate:
- Foundational GRC knowledge, including a basic understanding of governance, risk assessment, internal controls, compliance concepts, and common regulatory or cybersecurity frameworks (e.g., NIST, ISO, FFIEC)
- Self-motivation and a strong work ethic
- Intellectual curiosity and a habit of asking why
- Critical thinking and sound judgment
- Willingness to learn deeply both independently and under supervision
- A genuine desire to grow into a long-term role in GRC and risk management
While education and certifications are valued, this role places equal importance on critical thinking, ownership, curiosity, and a strong desire to learn. Candidates who bring both foundational knowledge and the right personal qualities will be most successful.
Compensation and Location
• Base salary range: $55,000 – $65,000
• Bonus potential: 3–5% based on individual and company performance
• Employment type: Full Time
• Location: Fully remote, anywhere in the United States (one day on site if in the San Diego area where our Corporate Office is located). Please note: The team typically works 8 AM - 5 PM Pacific Standard Time Hours.
Why This Role
This role offers meaningful, hands-on experience in cybersecurity risk and GRC under experienced leadership and close mentorship. It is an excellent opportunity for someone genuinely excited to step into their first GRC analyst role, build a strong foundation in risk and compliance, and grow through real responsibility, accountability, and continuous learning. The position is well suited for a motivated self-starter who is eager to learn, ask thoughtful questions, and develop into a long-term GRC professional within a heavily regulated industry.
Mutual of Omaha Mortgage is an Equal Opportunity Employer, and we encourage diverse, talented, qualified applicants to apply. We offer an extensive compensation package. Benefits include:
- Vacation — Vacation hours accrue on a per pay period basis. Balance maximums are based on years of service.
- Paid Sick Time — 40 hours of paid sick time after 90 days of employment. State sick time requirements will be added as needed.
- 9 Paid Holidays + 1 Cultural Celebration Day (Floating Holiday)
- Multiple PPO Medical Plans, as well as HDHP eligible plan.
- Dental Coverage
- Vision Coverage
- Company Paid Life Insurance
- 401K with a generous employer match
- Additional Benefits including – Optional Life, FSA, Pet Insurance etc.
- Free Legal Services
- Employee Loan Program
