Senior Risk Analyst

Overview

Senior Risk Analyst to design, implement, and mature an enterprise security and operational risk framework that is quantitative-leaning and driven by live data.

What you'll do

• Design and implement a structured risk management program (taxonomy, scoring, risk appetite, escalation thresholds).
• Build and maintain an enterprise risk register as a living operational tool.
• Lead periodic risk identification workshops with business, engineering, and legal stakeholders.
• Use AI tools to monitor threat intelligence and keep risk information current between review cycles.
• Support TPRM activities with vendor risk assessments, scoring, and finding documentation.
• Produce executive-ready risk reports, dashboards, and risk summaries.

What you'll need

• 6+ years of experience in GRC, information security, risk management, or IT audit.
• Strong understanding of security and compliance frameworks including SOC 2, ISO 27001, NIST CSF 2.0, and CIS Controls.
• AI-native mindset using AI tools (LLMs, agents, automation) for substantive work with human validation.
• Proficiency with GRC platforms for evidence management and control testing (e.g., Drata, Vanta, AuditBoard, ServiceNow GRC).
• Experience supporting external audits (evidence collection, control walkthroughs, auditor interaction).
• Ability to interpret technical controls and translate findings into compliance and risk documentation.

Details

• Align risk program with ISO 27005, NIST RMF, or ISO 31000 as appropriate.
• Identify and assess AI-related risks (privacy, bias, explainability, misuse, agentic behavior, third-party AI dependencies).
• Support compliance with AI governance frameworks including ISO 42001, NIST AI RMF, and EU AI Act.