Risk and Compliance Analyst

Elanco•Indianapolis, IN

2d•Hybrid

About The Position

As a Risk and Compliance Analyst, you will be a key member of the Information Security team, helping to protect Elanco’s information and assets. In this role, you'll be responsible for advancing our information security risk management framework through partnership and analysis. You will work with stakeholders across the company—from system owners to functional leaders—to provide guidance, support, and analyses that improve our overall security posture and ensure we meet our governance objectives. This is an opportunity to help set the direction of security at Elanco and grow your skills in a dynamic, global environment.

Requirements

Bachelor's Degree or High School Diploma/GED with an equivalent level of experience.
A minimum of 2 years of experience in information security, risk management, audit, or a related field.
Proven analytical and problem-solving skills, with a strong ability to influence others and communicate complex technical topics to diverse audiences.
Qualified candidates must be legally authorized to be employed in the United States or the United Kingdom.

Nice To Haves

Professional certifications such as CISA, CRISC, CISSP, or similar.
Experience working in a global, matrixed organization and building cross-functional relationships.
Demonstrated strong learning agility and business acumen, with an understanding of solution lifecycle management.
Experience with Governance, Risk, and Compliance (GRC) tools.
Knowledge of common information security frameworks such as NIST (CSF, RMF) or ISO 27001.

Responsibilities

Develop and govern the information security risk and compliance lifecycle, including the creation and maintenance of security policies and standards to guide the organization.
Support the execution and continuous improvement of the Information Security Third-Party Risk Management (TPRM) program.
Partner with IT, Operational Technology (OT), and DevSecOps teams to consult on complex security issues and build, maintain, and operate governance processes.
Discover and maintain risks and issues in the security register, supporting strategic projects and reporting to Enterprise Risk Management.
Provide effective communication and guidance to technical and non-technical audiences, fostering a culture of teamwork and continual learning.