Job Description
Job Overview
The Senior IT Risk Analyst is responsible for enhancing the maturity of IT risk management processes, supporting risk assessment activities (including ISMS risk assessments), and assisting in managing the overall approach to information risk and controls.
Scope Of Work / Responsibilities
In close coordination with the IT Assurance, Risk, and Controls Team, the Senior IT Risk Analyst will:
Update and streamline IT risk management frameworks and processes to improve operational maturity and alignment with organizational standards
Conduct IT operational risk assessments in collaboration with subject matter experts from IT and business units
Engage senior stakeholders in risk assessment discussions and mitigation planning
Prepare and review risk assessment reports to ensure accuracy and relevance
Conduct Security License to Operate (SLTO) reviews to ensure risk and compliance controls are in place prior to production deployment
Evaluate unresolved high-risk issues and recommend mitigation strategies to support go-live decisions
Facilitate IT policy exception and deferment processes, and monitor action plans
Ensure IT risk data in GRC tools is accurate, updated, and properly maintained
Prepare risk reports and dashboards, and communicate insights to IT teams and governance groups
Promote a risk-aware culture through effective communication and awareness initiatives
Coordinate IT risk reporting with the Office of Risk Management (ORM), including KRIs, operational risks, and risk appetite
Review IT policies and procedures in coordination with the IT Controls and Compliance Team
Support ISO 27001 risk assessment activities and related information security initiatives
Perform other related duties as assigned
Requirements And Qualifications
Education
Bachelors degree in Business Administration, Accounting, Computer Science, Information Technology, Industrial Engineering, or a related field
Experience
Minimum of 5 years of experience in IT risk, governance, and controls
Strong knowledge of frameworks such as SOX, COSO, COBIT, NIST, PMBOK, ISO 27001, SWIFT CSCF, and DORA
Good understanding of audit principles, standards, and procedures
Broad knowledge of enterprise IT environments
Strong written and verbal communication skills in English, with the ability to engage senior stakeholders
Technical Skills
Experience with GRC tools
Proficiency in Microsoft Office 365
Experience with reporting tools such as Power BI
Soft Skills
Strong analytical and problem-solving skills
High attention to detail and a methodical approach to work
Ability to collaborate effectively with internal and external stakeholders
Strong teamwork and interpersonal skills
Certifications (Preferred)
Relevant certifications such as CRISC, CISA, ISO 27001, or equivalent
