Risk Assessment and ERM Lead, gTech Risk

Google•Chicago, IL

6d•$140,000 - $204,000

About The Position

As part of gTech Risk, this role helps protect Google and its users by identifying and implementing controls for significant risks. The team analyzes gTech business processes to find control gaps, collaborates with stakeholders to address them, and provides risk expertise to engineer innovative solutions. The Risk Assessment and Enterprise Risk Management (ERM) Lead manages execution against Google frameworks and standards for understanding, assessing, and managing gTech’s most impactful risks. The role leads standardization of minimum control artifacts and maps complex operational, security, regulatory, and business-resilience obligations to gTech processes, identifying control gaps before they become incidents. The role supports gTech’s annual risk assessment and leads engagement with second-line-of-defense control functions.

Requirements

Bachelor’s degree or equivalent practical experience.
8 years of experience in technical project management or a customer-facing role.

Nice To Haves

Master’s degree in Business, Statistics, Mathematics, Economics, Engineering, Applied Science, or a related field.
8 years of experience managing projects and working with analytics, software coding, or customer-side web technologies.
5 years of experience in Governance, Risk, and Compliance (GRC), risk assessment, internal audit, or compliance management.
Experience managing first-line engagement with GRC platforms.
Deep understanding of control mapping and risk-framework methodologies.
Strong analytical skills and ability to identify systemic control gaps within complex operational chains.

Responsibilities

Manage Google risk assessment frameworks and establish minimum control standards for all gTech product and workflow launches.
Lead the consolidation and migration of gTech risk data into the enterprise platform, establishing a resilient source of truth for gTech risk data.
Map complex risk obligations across gTech processes.
Conduct analyses and policy-obligation mapping to clarify operational risks and identify continuity risks for critical processes.
Perform systemic control mapping and gap identification, moving the organization from anecdotal assessments to standardized, evidence-based compliance by design.