Analista de riesgos

GRC Analyst - Junior.

The Associate Governance, Risk, and Compliance (GRC) Analyst – Third-Party Risk will play a key role in managing and assessing the risk posture of external partners, vendors, and service providers. This position will be responsible for executing the organization’s third-party risk management (TPRM) program, performing risk assessments, following standardized evaluation processes, and providing clear, data-driven risk ratings and recommendations to leadership .

In addition to third-party assessments, the analyst will support broader GRC initiatives, including policy management, control monitoring, compliance reviews, and risk reporting.

Key Responsibilities

Third-Party Risk Management

• Conduct comprehensive risk assessments of third-party vendors, suppliers, and partners based on established GRC frameworks and procedures.
• Evaluate vendor controls across domains such as data protection, cybersecurity, business continuity, and regulatory compliance.
• Document and track assessment results, findings, and remediation efforts in accordance with internal GRC standards.
• Provide clear, actionable risk ratings and summaries for leadership review and decision-making.
• Maintain consistent application of the standardized TPRM process and contribute to process improvement initiatives.

Governance, Risk, and Compliance Support

• Assist in maintaining the enterprise risk register and ensuring mitigation plans are monitored and updated.
• Support internal control reviews, compliance audits, and ongoing monitoring activities.
• Contribute to policy and procedure documentation, ensuring alignment with regulatory and industry frameworks.
• Help coordinate periodic risk reporting and key risk indicator (KRI) dashboards for senior management.
• Participate in GRC-related projects and system enhancements.
• Collaborate on continuous improvement initiatives to enhance automation, reduce risk, and improve user experience.

General Requirements

• 1–3 years of experience in Governance, Risk, and Compliance (GRC), IT Risk or Cybersecurity Compliance.
• Strong communication skills in English (written and verbal) to interact with global stakeholders.

Nice to have:

• Knowledge of industry frameworks such as NIST and GDPR (awareness level is acceptable; hands-on expertise not required).
• Experience documenting findings, risks, and remediation actions , with the ability to clearly communicate results to stakeholders.
• Basic understanding of Third-Party Risk Management (TPRM) concepts, including vendor assessments and risk rating methodologies.