Sr. IT Risk Analyst

AAA-The Auto Club Group

1d•$80,000 - $100,000•Hybrid

About The Position

Sr. IT Risk Analyst – The Auto Club Group What you will do: The Senior IT Risk Analyst executes and maintains the IT risk management program, including the identification, evaluation, and mitigation of information technology risks across the organization. Primary Duties and Responsibilities: Drive activities related to the IT risk management strategy in alignment with Enterprise Risk Management processes Organize and update IT risk management policies, standards, and processes Enforce alignment with company objectives and regulatory requirements Support training and development of ERM teammates, measuring performance of the team against a high performing culture and reporting on gaps Perform analysis of key IT Risk performance/risk indicators for management Coordinate internal and external IT risk assessments by driving the project plan as agreed to by IT Risk Management leadership and stakeholders Maintain the IT risk appetites and tolerances to align with organizational objectives and as defined by ERM leadership Conduct monitoring of 1st line access reviews for general users, privileged users, and passwords Lead the maintenance and enhancement of the IT risk register and control library by: Partnering with IT and risk stakeholders to ensure comprehensive documentation. Ensuring timely updates to risk and control records. Clearly assigning risk ownership across business and technology teams Drive regulatory readiness efforts and governance assessments for the IT controls environment by: Coordinating cross-functional efforts across business and technology teams. Identifying gaps in control coverage or compliance. Recommending remediation strategies to ensure alignment with applicable standards and regulations. Proactively identify and analyze emerging threats, technologies, and regulatory changes that may impact the organization’s IT risk posture. Provide expert insights and recommendations to stakeholders to support timely decision-making and strategic planning Lead the identification of changes in the organization that will impact the risk landscape (major system implementations, acquisitions) and execute controls readiness activities with owners and stakeholders Coordinate and deliver training to company stakeholders on IT risk Contribute to Enterprise Risk Management team’s reporting and processes (e.g. key risks, watch list risks, AI Systems Program) Coordinate with IT risk stakeholder groups and IT risk owners across the organization (IT management, IT security, internal audit, legal, privacy, compliance, etc.)

Requirements

Bachelor’s degree in information technology, cybersecurity, risk management, computer science, or related area
5-7 years of experience in IT risk management, IT audit, cybersecurity, or related roles with experience mentoring junior team members and coordinating projects
Prior experience with IT risk management frameworks (e.g. NIST CSF, COBIT) in the insurance or financial services industry
Proven growth in the ability to assess complex IT environments and articulate risk in business terms
Knowledge of: Property/casualty insurance industry operations and relevant regulatory requirements (e.g. NAIC Model Law, PCI-DSS)
Internal controls and core IT technologies and processes including network and operating systems, databases, change control tools and processes, computer systems operations, application and system development, help desk and incident monitoring, information security, data backup, retention and recovery, IT vendor management, asset management, disaster recovery)
Risk assessment methodologies and GRC tools
Skills: Strong written and verbal communication skills
Strategic thinking and business acumen
Decision making under uncertain conditions
Present complex problems in a concise and effective manner, especially when translating expectations between third line or external audit assurance groups and first line risk and controls owners within IT
Influence various levels of management by ensuring strong relationship management and value demonstration to a wide set of stakeholders
Identify, assess, and prioritize IT risks
Multitask and work closely and effectively with other employees
Communicate and report to business and IT stakeholders
High degree of attention to detail and organization
Maintain a high volume of work with few mistakes or delays

Nice To Haves

Education: Master’s degree in Information Technology, Cybersecurity, Risk Management, Computer Science, or related area; MBA also considered
One or more of the following professional certifications such as CISA, CISM, CRISC, or CISSP are strongly preferred
Experience with: IT systems and technologies including ServiceNow, Saviynt, Workday, SAP, Salesforce, Guidewire
IT risk management for emerging technologies such as AI, machine learning, cloud computing, process automation, data analytics, etc.

Responsibilities

Drive activities related to the IT risk management strategy in alignment with Enterprise Risk Management processes
Organize and update IT risk management policies, standards, and processes
Enforce alignment with company objectives and regulatory requirements
Support training and development of ERM teammates, measuring performance of the team against a high performing culture and reporting on gaps
Perform analysis of key IT Risk performance/risk indicators for management
Coordinate internal and external IT risk assessments by driving the project plan as agreed to by IT Risk Management leadership and stakeholders
Maintain the IT risk appetites and tolerances to align with organizational objectives and as defined by ERM leadership
Conduct monitoring of 1st line access reviews for general users, privileged users, and passwords
Lead the maintenance and enhancement of the IT risk register and control library by: Partnering with IT and risk stakeholders to ensure comprehensive documentation. Ensuring timely updates to risk and control records. Clearly assigning risk ownership across business and technology teams
Drive regulatory readiness efforts and governance assessments for the IT controls environment by: Coordinating cross-functional efforts across business and technology teams. Identifying gaps in control coverage or compliance. Recommending remediation strategies to ensure alignment with applicable standards and regulations.
Proactively identify and analyze emerging threats, technologies, and regulatory changes that may impact the organization’s IT risk posture.
Provide expert insights and recommendations to stakeholders to support timely decision-making and strategic planning
Lead the identification of changes in the organization that will impact the risk landscape (major system implementations, acquisitions) and execute controls readiness activities with owners and stakeholders
Coordinate and deliver training to company stakeholders on IT risk
Contribute to Enterprise Risk Management team’s reporting and processes (e.g. key risks, watch list risks, AI Systems Program)
Coordinate with IT risk stakeholder groups and IT risk owners across the organization (IT management, IT security, internal audit, legal, privacy, compliance, etc.)