Enterprise Risk Analyst

BluPeak Credit Union•San Diego, CA

1d•$75,000 - $85,000

About The Position

The Enterprise Risk Analyst supports BluPeak Federal Credit Union’s enterprise-wide risk management programs, including risk governance, due diligence, control monitoring, issue management, contract oversight, and risk assessment across business relationships. The role develops metrics using multiple data sources and internal systems to measure third-party risk exposure, performance, costs, and return on investment, helping leadership make informed decisions. The Analyst works with management to maintain and improve the third-party risk management framework, policies, and processes in alignment with regulatory expectations, business needs, and enterprise risk appetite. The role recommends risk tiering, assessment and performance methodologies, and minimum control standards, and supports consistent application of these requirements during vendor onboarding and ongoing oversight. The position administers and optimizes GRC tools and data, produces governance reports and presentations for senior management and committees, and leads continuous improvement initiatives as directed by management. It evaluates metrics to help ensure third-party relationships remain secure, meet regulatory requirements and service level agreements, and support the credit union’s strategic objectives. The role also supports administration of AI-related tools and automation initiatives intended to improve program efficiency, consistency, and reporting accuracy. The Analyst serves as the GRC platform administrator, supports and trains platform users, manages vendor risk workflows and reporting, analyzes vendor spend and performance, and coordinates contract lifecycle tracking and vendor reviews. The position also supports adjacent risk programs, regulatory examinations, enterprise risk initiatives, and other duties as assigned. It does not supervise staff, but may act in a lead capacity for projects, initiatives, processes, and situations. The employee works in the office as necessary during regular business hours, with occasional nights or weekends and possible scheduling flexibility or overtime to meet deadlines.

Requirements

Bachelor’s degree or equivalent work experience.
At least three years of related experience in Compliance, Risk Management, Legal, or a related field.
Enterprise Risk Management or Third-Party Risk Management experience involving procurement, contract management, and/or vendor management.
Strong computer skills and willingness to learn GRC-specific software.
Strong reporting and analytical skills.
Advanced experience with Microsoft Office applications, including Excel, Word, PowerPoint, and Access.
Effective written and verbal communication, analytical, and interpersonal skills.
Strong problem-solving and critical-thinking skills.
Professional, service-focused communication etiquette.
Ability to stay organized, work efficiently, prioritize tasks, and meet deadlines.
Ability to manage and administer processes with appropriate direction from management.
Attention to detail and ability to produce accurate, precise results.
Ability to work effectively with all levels of management and staff.
Exceptional communication skills and ability to prepare professional reports, business correspondence, policies, and procedures.
Ability to read, analyze, and interpret governmental regulations and governance requirements.
Sound judgment and critical thinking to evaluate situations, identify options, and determine effective actions.
Ability to identify risks and opportunities, anticipate complications, and make timely, informed decisions.
General knowledge of network and database use and concepts, and ability to learn and adapt to new systems and technologies.
Strong interpersonal skills, professional phone and email etiquette, initiative, and ability to motivate and influence others while maintaining trust and diplomacy.
Ability to manage multiple projects and competing priorities, and to meet deadlines dependably.
Must have or be willing to obtain job-related certifications.
Ability to work in the office as necessary during regular business hours, with occasional nights or weekends as needed to meet department deadlines.

Nice To Haves

Experience in a financial institution is preferred.
Experience with SQL Server and Power BI is preferred.

Responsibilities

Administer the GRC platform, including access control, configuration management, workflow maintenance, and issue resolution.
Analyze GRC system data integrity and ensure records align with policy, legal, and regulatory requirements.
Troubleshoot system and data issues, identify root causes, and implement process improvements.
Use automation tools and AI-enabled features to improve data processing, reporting accuracy, workflow efficiency, and operational scale.
Respond to ad hoc analytics, reporting, and operational requests using system data and reporting tools.
Develop and deliver training materials, job aids, and documentation for the GRC platform and related tools.
Train and support end users on system functionality, workflows, reporting, data quality expectations, and proper system usage.
Promote adoption of automation and AI-enabled features through guidance, best practices, and enablement sessions.
Provide operational support to adjacent risk programs and initiatives and assist with ad hoc projects and strategic goals within the risk organization.
Analyze vendor spend across internal data sources and enterprise systems to identify cost trends, savings opportunities, and outlier activity.
Collaborate with business units to develop, validate, and track pre-engagement business cases, including estimated savings, cost avoidance, and post-engagement performance.
Monitor vendor performance through KPI- and metric-based reporting to identify trends, exceptions, and emerging risk indicators.
Facilitate recurring vendor performance reviews to verify compliance with contractual commitments, service level agreements, and operational expectations.
Track contract lifecycle details, including remaining terms, renewal timelines, financial exposure, and optimization opportunities.
Oversee vendor risk workflows, including onboarding, due diligence, risk assessments, ongoing monitoring, and offboarding.
Maintain third-party risk dashboards and prepare materials for Vendor Oversight Committee governance forums.
Partner with Information Security to validate timely and accurate review of SOC reports and related control evidence.
Analyze vendor pricing proposals, RFP responses, and replacement scenarios by benchmarking current pricing and evaluating alternatives.
Collect, validate, and deliver documentation and reporting for regulatory examinations and enterprise risk initiatives.
Support other Regulatory Enterprise Risk functions as requested by management.
Recommend opportunities to improve efficiency, effectiveness, and risk reduction, and contribute to governance practices aligned with risk and compliance frameworks.
Follow company policies and procedures, complete annual compliance training, and comply with business continuity and vendor management policies.
Comply with applicable anti-money-laundering requirements, including BSA, OFAC, and USA PATRIOT Act obligations, related policies and procedures, customer identification and due diligence requirements, accurate OFAC match processing, and reporting unusual activity and suspected fraud.
Communicate complex information effectively across organizational levels and prepare professional reports, correspondence, policies, procedures, and presentations.
Read and interpret governmental regulations and governance requirements, and present findings clearly to leadership, staff, members, and external stakeholders.