ZipRecruiter

Log In

1

Cybersecurity Risk Management Jobs in Tucson, AZ

Varsity Tutors

Cyber Security Tutor

Tucson, AZ · Remote

$18 - $40/hr

Emphasizes a systematic approach to security assessment and connects cybersecurity to business risk management, compliance requirements, and ethical computing practices. * Curriculum Awareness ...

next page

Showing results 1-20

All JobsCybersecurity Risk Management JobsCybersecurity Risk Management Jobs in Tucson, AZ

Cybersecurity Risk Management information

See Tucson, AZ salary details

$52.9K

$123.5K

$172.7K

How much do cybersecurity risk management jobs pay per year?

As of Jul 16, 2026, the average yearly pay for cybersecurity risk management in Tucson, AZ is $123,463.00, according to ZipRecruiter salary data. Most workers in this role earn between $103,100.00 and $139,300.00 per year, depending on experience, location, and employer.

Can I make $200,000 a year in cyber security?

Cybersecurity risk management professionals can earn $200,000 or more annually, especially with extensive experience, advanced certifications like CISSP or CISM, and roles in senior management or specialized fields. Salary levels vary based on industry, location, and the complexity of the organization's security needs.

What are some common challenges faced by professionals in Cybersecurity Risk Management, and how can they be addressed?

Professionals in Cybersecurity Risk Management often encounter challenges such as keeping up with rapidly evolving cyber threats, balancing security needs with business objectives, and ensuring compliance with industry regulations. Addressing these challenges requires continuous learning, effective communication with stakeholders, and close collaboration with IT, legal, and business teams. Building strong partnerships across departments and investing in ongoing training can help mitigate these obstacles and support proactive risk management.

How much does a cybersecurity risk analyst make?

A cybersecurity risk analyst typically earns between $70,000 and $120,000 annually, depending on experience, certifications, and location. Entry-level positions may start lower, while experienced analysts with certifications like CISSP or CISA can earn higher salaries, especially in high-demand industries.

What is the difference between Cybersecurity Risk Management vs Cybersecurity Analyst?

AspectCybersecurity Risk ManagementCybersecurity Analyst
CertificationsCRISC, CISSP, CISMCompTIA Security+, CEH, CISSP
Work EnvironmentRisk assessment, policy development, strategic planningMonitoring security systems, incident response, vulnerability analysis
Employer & Industry UsageFinancial, healthcare, government, large enterprisesIT departments, cybersecurity firms, corporate security teams

Cybersecurity Risk Management focuses on identifying, assessing, and mitigating security risks at an organizational level, often involving policy creation and strategic planning. In contrast, a Cybersecurity Analyst primarily monitors security systems, responds to incidents, and analyzes vulnerabilities. Both roles require similar certifications but serve different functions within cybersecurity teams.

What are the key skills and qualifications needed to thrive in Cybersecurity Risk Management, and why are they important?

To thrive in Cybersecurity Risk Management, you need a solid understanding of information security principles, risk assessment methodologies, compliance standards, and typically a degree in cybersecurity or a related field. Familiarity with risk management frameworks (such as NIST or ISO 27001), security tools, and professional certifications like CISSP or CRISC is highly valued. Strong analytical thinking, effective communication, and problem-solving skills help professionals translate technical risks for non-technical stakeholders and foster collaboration. These competencies are crucial to proactively identifying threats, managing vulnerabilities, and ensuring organizational resilience in a rapidly evolving digital landscape.

What does a cyber risk manager do?

A cyber risk manager assesses and prioritizes cybersecurity threats to an organization, develops strategies to mitigate risks, and implements security policies. They often use tools like risk assessment frameworks and require certifications such as CISSP or CISM to effectively manage security risks and ensure compliance.

What is cybersecurity risk management?

Cybersecurity risk management is the process of identifying, assessing, and prioritizing risks to an organization's digital assets and information systems. It involves implementing strategies and controls to minimize the impact of potential cyber threats, such as data breaches, malware, and unauthorized access. The goal is to balance security measures with business needs, ensuring sensitive information remains protected while maintaining operational efficiency. Effective risk management is ongoing, adapting to new threats and changes within the organization.

Can you make $500,000 a year in cyber security?

Cybersecurity risk management professionals can potentially earn $500,000 or more annually, especially at senior levels, in leadership roles, or with extensive experience and specialized certifications like CISSP or CISM. High salaries are often associated with executive positions, consulting, or working for large organizations with complex security needs.
What are popular job titles related to Cybersecurity Risk Management jobs in Tucson, AZ? For Cybersecurity Risk Management jobs in Tucson, AZ, the most frequently searched job titles are:
What job categories do people searching Cybersecurity Risk Management jobs in Tucson, AZ look for? The top searched job categories for Cybersecurity Risk Management jobs in Tucson, AZ are:
What cities near Tucson, AZ are hiring for Cybersecurity Risk Management jobs? Cities near Tucson, AZ with the most Cybersecurity Risk Management job openings:
Cybersecurity Risk Management jobs near you
Information Technology - Information Security Officer (ISO)

Information Technology - Information Security Officer (ISO)

MHC Healthcare

Marana, AZ • On-site

Full-time

Posted 7 days ago

Job description

Marana Health is seeking an Information Security Officer (ISO) to join the Information Technology team at the Marana Main Health Center, located in the heart of Marana, AZ.
The Information Security Officer (ISO) is responsible for. providing enterprise leadership, accountability and subject matter expertise for information security, cybersecurity, compliance, risk management, and governance activities. The ISO serves as the organization's primary authority on the protection, governance, and responsible use of information assets, ensuring compliance with regulatory requirements while supporting organizational growth, innovation, and patient care.
This position develops and maintains enterprise-wide security, governance, and risk management frameworks that safeguard organizational data and technology resources. The ISO collaborates closely with executive leadership, Information Technology, Clinical Informatics, Compliance, Operations, Human Resources, and business stakeholders to establish policies, standards, and governance processes that support organizational objectives.
The ISO is responsible for leading the organization's Security Risk Analysis (SRA), cybersecurity risk management, PCI compliance, data governance, AI governance, vendor risk management, and regulatory compliance programs.
The ISO serves as a trusted advisor to executive leadership regarding cybersecurity strategy, HIPAA Security Rule compliance, contingency planning, data governance, AI governance, enterprise risk management, regulatory compliance, and emerging technology risks.
Marana Health is a Federally Qualified Community Health Center (FQHC), with 11 sites in Tucson and Pima County. Our mission is to improve our community by providing exceptional, whole-person healthcare.
The following qualifications are required:
  • Bachelor's degree in Information Security, Cybersecurity, Information Technology, Information Systems, Computer Science, Healthcare Informatics, Business Administration, or related field required.
  • Minimum seven (7) years of progressively responsible experience in information security, cybersecurity, risk management, governance, compliance, or healthcare technology leadership, including experience conducting Security Risk Analyses (SRA), risk management activities, and regulatory compliance initiatives.
  • Minimum three (3) years of experience developing, implementing, or managing enterprise security, governance, or compliance programs.
  • Fingerprint Clearance Card through the Arizona Department of Public Safety.
  • Current Arizona driver's license with clean driving record and proof of current vehicle insurance (39-month MVR will be run by MH)
  • Experience conducting risk assessments, developing policies, and implementing security controls.
  • Experience managing vendor security reviews and regulatory compliance initiatives.
  • Experience leading cross-functional projects and organizational initiatives.
  • Experience presenting information to executive leadership and organizational stakeholders.
  • Strong understanding of ambulatory healthcare workflows and healthcare operations.

The following qualifications are preferred:
  • Master's degree in Information Security, Cybersecurity, Information Technology, Healthcare Informatics, Business Administration, or related field.
  • Experience supporting Federally Qualified Health Centers (FQHCs), healthcare systems, or ambulatory healthcare organizations.
  • Experience serving as a HIPAA Security Officer or equivalent security leadership role.
  • Experience implementing NIST Cybersecurity Framework, CIS Controls, HITRUST, or similar governance and security frameworks.
  • Experience leading enterprise data governance initiatives.
  • Experience developing AI governance programs and responsible technology governance frameworks.
  • Experience managing regulatory audits, security assessments, and compliance reviews.
  • Experience leading enterprise Security Risk Analyses (SRA), risk remediation programs, and regulatory compliance initiatives.
  • Experience managing PCI DSS compliance programs, assessments, and remediation activities.

CERTIFICATIONS
One or more of the following certifications is preferred:
  • CISSP - Certified Information Systems Security Professional
  • HCISPP - Healthcare Information Security and Privacy Practitioner
  • CISM - Certified Information Security Manager
  • CRISC - Certified in Risk and Information Systems Control
  • CISA - Certified Information Systems Auditor
  • CDMP - Certified Data Management Professional
  • Security+

Equivalent combination of education and experience may be considered if applicable and must be directly related to the functions and body of knowledge required to successfully perform the job.
The ideal candidate will also possess the following knowledge, skills, and abilities:
  • Thorough knowledge of HIPAA Security Rule requirements and healthcare cybersecurity practices.
  • Strong understanding of data governance, data stewardship, data quality, data lifecycle management, and information management principles.
  • Knowledge of NIST Cybersecurity Framework, CIS Controls, HITRUST, and other industry-recognized security standards.
  • Understanding of cloud security, identity and access management, network security, endpoint protection, vulnerability management, and incident response.
  • Knowledge of vendor risk management, third-party security assessments, and contract security requirements.
  • Understanding of AI governance frameworks, emerging technologies, and associated security and compliance risks.
  • Knowledge of Security Risk Analysis (SRA) methodologies, risk assessment frameworks, and risk management best practices.
  • Knowledge of PCI DSS requirements and payment card security standards.
  • Ability to develop and implement organizational policies, standards, and governance frameworks.
  • Ability to communicate complex technical concepts effectively to executive, clinical, operational, and non-technical audiences.
  • Knowledge of contingency planning, business continuity planning, disaster recovery planning, and emergency preparedness frameworks.
  • Ability to develop, implement, test, and maintain organizational contingency and recovery plans for critical business and technology functions.
  • Strong analytical, organizational, problem-solving, and project management skills.
  • Ability to build collaborative relationships across departments and influence organizational decision-making.
  • Excellent written, verbal, presentation, and facilitation skills.
  • Ability to manage multiple priorities and initiatives in a dynamic healthcare environment.

Duties and Responsibilities:
Information Security Leadership
  • Develop, implement, and maintain a comprehensive enterprise information security program aligned with organizational goals and industry best practices.
  • Establish and maintain information security policies, standards, procedures, and controls.
  • Lead cybersecurity governance initiatives and provide strategic guidance to executive leadership.
  • Develop and maintain cybersecurity, compliance, governance, and risk management metrics, dashboards, and key performance indicators (KPIs) for executive leadership and organizational reporting.
  • Conduct organizational security risk assessments and develop mitigation strategies.
  • Monitor and communicate emerging cybersecurity threats and risks affecting healthcare organizations.
  • Provide leadership for security-related projects and organizational initiatives.

Data Governance and Information Management
  • Coordinate and facilitate organizational data governance activities and maintain accountablility in partnership with Clinical Informatics, Analytics, Compliance, and operational leaders
  • Establish enterprise data governance policies, standards, and procedures.
  • Partner with clinical, operational, financial, and technology leaders to define data ownership, stewardship, and accountability.
  • Coordinate Data Governance Committee activities and governance initiatives.
  • Establish standards for data classification, retention, access, sharing, archival, and disposal.
  • Promote data quality, integrity, consistency, and reliability across organizational systems.
  • Maintain enterprise data inventories and support data lineage and information asset management efforts.
  • Collaborate with Clinical Informatics, Enterprise Analytics, Compliance, and operational leadership to establish governance standards for clinical, operational, financial, and artificial intelligence data assets.
  • Monitor organizational data quality issues and facilitate remediation efforts.
  • Establish governance processes supporting responsible and ethical use of organizational data.

Cybersecurity Operations
  • Oversee vulnerability management, security monitoring, incident response, and threat mitigation efforts.
  • Coordinate investigations and response activities related to security incidents and data breaches.
  • Lead business continuity and disaster recovery security planning activities.
  • Review and provide security oversight for new systems, applications, integrations, cloud services, artificial intelligence technologies, and technology initiatives to ensure alignment with organizational security standards, regulatory requirements, and risk management objectives.
  • Collaborate with Information Technology teams to implement and maintain appropriate security controls.
  • Monitor organizational compliance with established security standards and policies.

Incident Response and Cybersecurity Event Management
  • Serve as the organizational lead for cybersecurity incidents, coordinating incident response activities, executive communications, regulatory notification requirements, remediation efforts, and post-incident reviews.
  • Coordinate with Information Technology, Compliance, Human Resources, Legal, and executive leadership during cybersecurity incidents, data breaches, and security investigations.
  • Develop and maintain incident response procedures, escalation processes, and communication plans.
  • Conduct periodic incident response exercises and lessons-learned reviews to improve organizational preparedness and resilience.

HIPAA Security and Regulatory Compliance
  • Serve as the organization's designated HIPAA Security Officer and maintain accountability for implementation, monitoring, and ongoing compliance with HIPAA Security Rule requirements.
  • Ensure compliance with HIPAA Security Rule requirements and other applicable regulatory requirements.
  • Own, coordinate, and execute the organization's enterprise-wide Security Risk Analysis (SRA) program, including annual assessments, ongoing risk evaluations, risk identification, remediation planning, and executive reporting.
  • Develop, maintain, and monitor corrective action plans resulting from Security Risk Analyses, security audits, penetration tests, vulnerability assessments, and compliance reviews.
  • Coordinate and maintain required security risk analyses and risk management activities.
  • Lead security-related audit preparation and responses.
  • Develop and maintain documentation supporting regulatory compliance.
  • Monitor changes in regulations and industry standards and advise leadership regarding organizational impacts.
  • Collaborate with Compliance and Legal teams on privacy and security initiatives.

Contingency Planning, Business Continuity, and Disaster Recovery
  • Develop, implement, and maintain the organization's contingency planning program in accordance with HIPAA Security Rule requirements and industry best practices.
  • Lead the development and maintenance of Business Continuity Plans (BCPs), Disaster Recovery Plans (DRPs), Emergency Operations Plans, and technology recovery procedures.
  • Conduct Business Impact Analyses (BIAs) to identify critical systems, applications, processes, and recovery priorities.
  • Coordinate periodic testing, tabletop exercises, and validation of contingency, business continuity, and disaster recovery plans.
  • Partner with Information Technology, Clinical Operations, Facilities, and organizational leadership to ensure continuity plans support patient care and business operations during disruptions.
  • Monitor and report on organizational readiness related to business continuity, disaster recovery, and emergency preparedness activities.
  • Coordinate corrective action plans resulting from contingency plan testing, disaster recovery exercises, and actual events.
  • Ensure contingency planning activities align with organizational risk management, regulatory compliance, cybersecurity, and operational resilience objectives.

Vendor Risk Management
  • Develop and maintain a third-party risk management program.
  • Conduct security assessments of vendors, business associates, and technology partners.
  • Review Business Associate Agreements (BAAs) and security requirements for third-party relationships.
  • Participate in procurement and contract review processes to ensure appropriate security and compliance protections.
  • Identify and mitigate risks associated with vendor relationships and system integrations.

Artificial Intelligence (AI) Governance
  • Maintain accountability for AI governance standards while providing security, privacy, and risk guidance related to AI initiatives
  • Evaluate privacy, security, ethical, and regulatory considerations associated with AI technologies.
  • Collaborate with Clinical Informatics, Operations, Compliance, and IT leadership regarding AI initiatives.
  • Establish governance frameworks supporting responsible AI adoption and use.
  • Monitor emerging AI regulations, guidance, and industry best practices.
  • Ensure AI initiatives align with organizational g

Apply