Senior Risk and Compliance Analyst

Position Summary:

The Senior Risk and Compliance Analyst is a key member of the IT Governance, Risk, and Compliance (GRC) team, responsible for supporting and advancing the organization’s IT risk, compliance, and third-party risk management(TPRM)programs. This role partners with stakeholders across IT, Information Security, Procurement, Legal, OT, and the business to assess technology and vendor-related risks, strengthen governance practices, and support risk-informed decision-making.

The Analyst will help lead and mature the IT Third-Party Risk Management (TPRM) program by supporting vendor risk assessments, due diligence, ongoing monitoring, remediation tracking, and continuous improvement efforts. This role also contributes to risk intake, reporting, metrics, and automation initiatives that improve visibility, consistency, and efficiency across the broader GRC program.

Responsibilities: 

• Act as anadvisor for IT GRC, providing guidance to IT and business stakeholders while advancing strategic GRC initiatives.

• Lead and enhancethe IT third-party risk management program, encompassing vendor risk assessments, onboarding procedures, ongoing monitoring, and remediation of identified risks.

• Collaborate with Information Security, IT,Procurement, Legaland business teams to evaluate third-party vendors, applications, and services enterprise-wide.

• Review third-party security documentation, including SOC reports, ISO certifications, security questionnaires, policies, and other relevant evidence to assess control maturity and residual risk.

• Partner with the Security Operations Center (SOC) to monitor emerging threats, industry developments, and incident response insights, leveraging findings to assess and refine the risk profiles of critical vendors and technology supply chain partners.

• Supportthe end-to-end risk intake workflow,help tomaintain the IT risk registerprocess, and ensure timely escalationof technology risks.

• Collaborate withthe IT Compliance Managers to supportrisk assessments for internal initiatives,third-party relationships, and critical business processes.

• Contribute to the development ofsecurity metrics and dashboards, leveraging automated and manual processes to produce relevant KRIs/KPIs that measure and communicate risk exposure and program effectiveness.

• Maintain current knowledge of industry best practices and monitor the legal and regulatory environment for developments that may require changes to policies and practices.

• Drive automation efforts within the GRC and third-party risk programs by identifying manual or repetitive tasks and implementing technology solutions, or workflow tools to improve efficiency, consistency, and reporting.

• Continuously seek opportunities to optimize and modernize GRC operations through technical innovation and automation.

Required Qualifications:

• 4or moreyears of experience in Information Security, Risk Management, Audit, IT Governance, IT Compliance, orrelateddiscipline.

• Proven ability to lead and mature an IT Third-Party Risk Management (TPRM) program, including governance, risk assessments, and continuous improvement initiatives.

• Strong understanding of third-party risk management practices across the vendor lifecycle, including due diligence, onboarding, ongoing monitoring, remediation, and offboarding.

• Broad, generalist understanding of information security risk and compliance—comfortable operating across risk, audit, policy, and third-party risk areas.

• Working knowledge of industry frameworks and regulatory requirements, including NIST, ISO, CIS, PCI-DSS, SOX, GDPR, CCPA, and HIPAA.

• High degree of ownership, self-direction, and demonstrated thought leadership.

• Ability to analyze manual processes and implement technical solutions to enhance efficiency and accuracy.

PreferredQualifications:

• Bachelor’s degree in business administration, compliance, information systems, privacy, orrelatedfield; equivalent work or education-related experience considered.

• One or more relevant certifications: CRISC, CISSP, CISA, CISM, CGEIT, GCCC, GSEC, GISP.

• Proven ability to interact with key stakeholders and align priorities based on risk.

• Familiarity with GRC platforms (e.g.,LogicGate, Optro, OneTrust,Workiva).

• Strong written and verbal communication skills; able to present complex risk and compliance topics to both technical and non-technical audiences.

• Proficient in Microsoft Excel, Word, and PowerPoint.

ADA Physical/Mental/Workplace Requirements:

• Occasional lifting up to 25 lbs

• Sitting, working at desk/personal computer for extended periods of time

• Primary work environment is professional corporate office

• Ability to travel commercially and internationally.

#LI-JV1