Senior Risk and Compliance Analyst

About the role

The Senior Risk and Compliance Analyst joins the IT Governance, Risk, and Compliance (GRC) team to drive the organization’s IT risk, compliance, and third‑party risk management programs. Working closely with IT, Information Security, Procurement, Legal, OT and business stakeholders, the analyst will help shape risk‑informed decisions and strengthen governance practices.

Key responsibilities

• Act as an advisor for IT GRC, guiding IT and business stakeholders on strategic initiatives.
• Lead and enhance the IT Third‑Party Risk Management program, including vendor risk assessments, onboarding, ongoing monitoring and remediation.
• Collaborate with Information Security, Procurement, Legal and business teams to evaluate vendors, applications and services across the enterprise.
• Review third‑party security documentation such as SOC reports, ISO certifications, security questionnaires and policies to assess control maturity and residual risk.
• Partner with the Security Operations Center to incorporate emerging threat intelligence into vendor risk profiles.
• Support the end‑to‑end risk intake workflow, maintain the IT risk register and ensure timely escalation of technology risks.
• Work with IT Compliance Managers on risk assessments for internal initiatives and critical business processes.
• Develop security metrics and dashboards (KRIs/KPIs) using automated and manual processes.
• Monitor industry best practices and regulatory changes, updating policies as needed.
• Identify manual tasks and drive automation through technology or workflow tools to improve GRC efficiency.

Required profile

• Minimum 4 years of experience in Information Security, Risk Management, Audit, or IT Governance.
• Proven ability to work cross‑functionally with technical and business teams.
• Strong analytical mindset with a focus on continuous improvement.

Required skills