Senior Operational Risk and Reporting Analyst

Groq•Worth, IL

7h•$127,500 - $172,500

About The Position

Groq is seeking a Senior Operational Risk and Reporting Analyst to make GRC risk reporting a continuous operation, communicate risk in terms of business impact, and own the third-party risk program. The role turns an annual risk exercise into a monthly operating rhythm and tracks remediation across every framework in the program. The analyst centralizes risk data and produces executive-ready monthly reporting for security leadership. They manage the third-party risk program end to end, including vendor tiering, assessments, report reviews, remediation tracking, and vendor assessment controls in the GRC tool. They also ensure that open findings across frameworks have an owner, target date, and disposition. Groq describes its culture as purposeful, builder-oriented, mission-driven, focused on solving hard problems, and committed to high performance. The U.S. total cash salary range is $127,500–$172,500, inclusive of potential bonus value; placement depends on location, experience, skills, and internal compensation standards. International compensation varies by local market. Groq also offers a Long-Term Incentive Program and employee benefits.

Requirements

At least 5 years of experience in operational risk, IT risk, or GRC, including building and running risk assessment and reporting processes end to end in a regulated environment.
Experience producing monthly risk reporting for risk committees and executives.
Experience testing controls for effectiveness.
Experience evaluating new initiatives for risk exposure before implementation, including third-party risk assessments.

Nice To Haves

Experience with GRC tooling.

Responsibilities

Build and run GRC risk reporting as a continuous operation, including intake, scoring against the risk methodology, treatment tracking, and risk acceptance with owners and expiry dates.
Centralize risk registers, KRIs, audit findings, and critical vendor information into dashboards for leadership.
Produce monthly risk reports for security leadership, framing risk by business impact rather than control count and providing executive-ready commentary.
Own the third-party risk program end to end, including vendor tiering, tier-based security assessment cadence, review of vendor SOC 2 and ISO reports, remediation tracking, and clearing the vendor assessment control in the GRC tool.
Track remediation across all frameworks so every open finding has an owner, a date, and a disposition, and report aging monthly.