Senior Risk Analyst

Key Responsibilities

Senior Risk Judgment Advisory

• Serve as the senior analytical authority for complex, high-tier risk cases - including Cyber Risk, AI risk, cross-jurisdictional privacy complexity, and novel technology types not clearly addressed by existing framework
• Provide risk advisory support to IT leadership, BISOs, Legal/Privacy, and business stakeholders - translating complex risk landscapes into clear, actionable guidance
• Own the integrity of the risk determination record for high-profile or sensitive programs; provide independent review where risk signals are ambiguous or where determinations carry material business or regulatory consequence
• Guide analysts on when to accept, challenge, escalate, or override risk outputs - serving as a calibration resource and quality anchor for the team

Framework Stewardship Continuous Monitoring

• Monitor patterns across risk assessments - override rates, exception volumes, flag frequencies - to identify systematic accuracy issues, framework gaps, or emerging risk themes
• Support continuous monitoring initiatives and contribute to the evolution of BMSs integrated risk framework (Scope Screening Regulatory Classification Risk-Tiered Controls) as the operating model matures
• Identify where the risk tiering model, control library, or assessment logic may need refinement; articulate improvement recommendations with supporting evidence to Risk Leads and leadership
• Contribute to periodic reviews of auto-approved projects, leading structured assessments where findings may have broader programmatic implications

Stakeholder Leadership Cross-Functional Engagement

• Lead engagement with senior project sponsors, IT architects, Legal/Privacy SMEs, and Compliance teams on high-risk or high-complexity assessments
• Represent the IT Risk function in cross-functional forums; provide subject matter expertise on regulatory risk implications (GDPR, EU AI Act, GxP, NIST frameworks)
• Build and maintain strong partnerships across IT, Legal, Privacy, Cybersecurity, and Business functions; act as a trusted advisor rather than a compliance gatekeeper
• Support escalation resolution between Risk Leads, BISOs, Privacy SMEs, and project teams; facilitate closure on disputes involving risk determinations and framework interpretation

Operational Excellence Governance

• Ensure audit-ready documentation standards across the team; review and validate complex SNOW and GRC records for accuracy, completeness, and audit defensibility
• Contribute to or lead training initiatives for analysts on evolving framework components, updated risk tiering logic, and operational workflow changes
• Support governance reporting; prepare executive-quality risk summaries, trend analyses, and control attestation packages for senior leadership and compliance audiences
• Provide UAT support for framework and tooling updates - including validating that risk outputs align with expected SME-level determinations

Mentorship Team Development

• Provide mentorship and guidance to junior analysts; support calibration, quality review, and professional development within the team
• Model the expected analyst behavior in an automation-enabled environment: review-first, judgment-driven, override with rationale, and escalate with clarity

Qualifications Experience

Required

• 5-10 years of progressive experience in IT risk management, cybersecurity risk, IT audit, privacy compliance, or a closely related field
• Demonstrated track record of independent, senior-level risk judgment - including experience handling complex, ambiguous, or high-stakes risk determinations
• Deep knowledge of NIST Cyber Risk Management Framework, NIST 800-53 controls library, and at least one major privacy regulatory framework (GDPR, EU AI Act, GxP, CCPA)
• Experience working with GRC platforms at an advanced level (ServiceNow GRC or equivalent); ability to review, validate, and ensure quality of records produced by others
• Strong executive communication skills; experience preparing and presenting risk findings to senior leadership or audit/compliance audiences
• Experience with AI/ML, automation, or emerging technology risk programs - including digital transformation and data privacy risk governance

Desired Candidate Characteristics

• Highly developed risk judgment - able to form defensible, well-reasoned positions on complex determinations and explain them clearly to any audience
• Advisory mindset: seen as a trusted partner by stakeholders, not just a process owner
• Comfortable with automation and system-generated risk signals as primary inputs - focused on interpreting and acting rather than manually gathering data
• Strategic thinker with an eye on where the risk function is heading, not just where it is today
• Strong influencer and collaborator; able to drive alignment across Legal, Privacy, IT, and Business without formal authority

Passion for healthcare and the belief that excellent risk management enables better science and better patient outcomes