Security risk and compliance manager job simulation
The analytics vendor risk exception
“The analytics vendor risk exception” is a security risk and compliance manager job simulation on FinderK.
You work at Brackenfield Retail Group, an original fictional company, and complete 3 assignments in about 80 minutes.
It is for anyone who wants to practice security risk and compliance manager work. No previous work experience is required.
Role
Security risk and compliance manager
Industry
Cybersecurity governance
Level
Mid-level
Time
About 80 minutes, 3 assignments
Access
Included in Plus
Created by
FinderK
Marketing wants a fast growing analytics vendor live before Black Friday, and it wants 1.2 million customers' names, emails and card digits. Assess the vendor's evidence, score the risk, design the controls that would make an exception acceptable, and keep the gate shut when the vendor reveals an old incident.
Read the full brief
You are the security risk and compliance manager at a retailer. A marketing director wants a US-hosted analytics service live in eighteen days for the biggest campaign of the year. The vendor's questionnaire says yes to almost everything, but its evidence shows optional sign-in security, a self-assessment instead of an audit, a penetration test nineteen months old and a seven day breach notice. You score the risk, work out which controls bring it within the security chief's authority, write the exception with the marketing director as risk owner, then rescore when the vendor discloses an incident it had not mentioned. Automated checks confirm your figures and saved work; your judgement is reviewed against the standard for the role.
What is Brackenfield Retail Group?
Brackenfield Retail Group is a fictional home and garden retailer with 140 stores, a website and an app used by about 1.2 million account holders. Marketing wants a US-hosted analytics vendor live before Black Friday. This case runs from Monday 2 to Thursday 12 November 2026. The security risk and compliance manager assesses and recommends; vendor management, the chief information security officer and the risk committee approve within the third-party security policy, and the business owner accepts residual risk.
Who do you play?
You are the security risk and compliance manager in the Information security team.
You assess suppliers against the third-party security policy and recommend. Vendor management approves fully compliant vendors; Ingrid Solberg approves Medium residual risk exceptions for up to 90 days; the risk committee approves High. Ravi Chandran accepts residual risk as risk owner. No customer data flows until approval is signed and every relied-on control is verified.
What will you do?
1. Assess the vendor and score the risk
25 minutes
2. Design the controls and recommend the exception
Ingrid Solberg, chief information security officer
Ravi Chandran, marketing director
Moira Fitzpatrick, data protection officer
Yusuf Kaya, data platform architect
Jake Morrow, head of security, Clickstream Lens
These coworkers are fictional. They may make mistakes, so compare their suggestions with the evidence.
Frequently asked questions
How long does “The analytics vendor risk exception” take?
About 80 minutes, across 3 assignments. When the time is up, you get 10 minutes to round up and submit. Pausing stops the clock.
Is “The analytics vendor risk exception” free?
No. It is included in FinderK Plus. With a free account you can also do it without grading.
Do I need security risk and compliance manager experience?
No. No previous work experience is required. The listed level is mid-level.
What do I get when I finish?
You get feedback on each assignment you submit. Completing all required assignments earns a completion certificate. It records participation and is not professional accreditation.
Is Brackenfield Retail Group a real company?
No. Brackenfield Retail Group is an original fictional company made for practice. Its coworkers may make mistakes, so check their suggestions against the evidence.
A member banned after a gym floor incident has asked for all the data held about her, including the names of who complained. Work out the real deadline, decide what is disclosed, redacted or withheld, write to her, and keep the record.
Skills: Work out a statutory deadline from the facts of receipt; Decide disclosure, redaction and exemptions record by record; Weigh a third party's interests against the requester's right; Write an honest response that withholds without revealing; Keep an accountable decision record
Release captain (senior software engineer) at Orla Books
About 80 minutes. Included in Plus.
Release 5.4 must get a new bank feed connector live before an aggregator switches off its old interface on 31 October, but Android crashes, a slow migration and a quarantined test stand in the way. Judge readiness, recommend a plan and roll it out without over-promising.
Skills: Judge release readiness against written criteria and evidence; Separate what a dashboard shows from what the policy counts; Recommend a release plan that protects a hard external deadline; Ask for only the exceptions the policy allows, with reasons; Plan a staged rollout and the communications that depend on it
Fog has held twelve morning flights and three crews whose duty limits are running out. Build a recovery plan that stays inside the limits without leaning on captains' discretion, look after the passengers, and replan when an island airport says it will close early.
Skills: Rebuild a flying programme within crew duty limits; Choose which service to protect when not all can run; Refuse to plan on discretion under pressure; Arrange passenger care and priority help through the right team; Replan quickly when a new constraint arrives
A client's finance director has told his board that closing a depot will save 3.04 million pounds a year. Rebuild the savings from the client's own data, tell the steering committee the true number in a deck, and correct it again when a depot manager's figure turns out to be wrong.
Skills: Separate costs that end from costs that move; Build a savings and payback model from client data; Present an unwelcome number answer first; Handle a client sponsor's expectations with evidence; Revise analysis openly when data changes