Job Summary
We are seeking an experienced Risk Analyst with strong hands-on expertise in ServiceNow Integrated Risk Management (IRM) and Governance, Risk, and Compliance (GRC) to support the identification, documentation, assessment, tracking, and management of enterprise risks and issues. The ideal candidate will have 5-7 years of relevant risk management or GRC experience, including at least 5 years of hands-on experience with ServiceNow IRM/GRC and direct experience creating, updating, tracking, and maintaining risk and issue records in the ServiceNow Risk Register. The role requires strong analytical skills, the ability to translate stakeholder input into clear and actionable risk statements, and a thorough understanding of the risk management lifecycle from identification and assessment through remediation, monitoring, and closure.
Key Responsibilities
• Work hands-on within ServiceNow IRM/GRC to manage enterprise risks and issues.
• Create, update, and maintain risk and issue records in the ServiceNow Risk Register.
• Ensure risk records contain accurate descriptions, categories, ownership, impact, likelihood, ratings, remediation plans, and status.
• Maintain the accuracy, completeness, and quality of risk-register information.
• Track open risks, issues, remediation activities, action items, and due dates through closure.
• Conduct regular reviews and updates to ensure risk records reflect the current risk posture.
• Support stakeholders in understanding and following ServiceNow IRM/GRC processes and requirements.
• Facilitate the intake and identification of new risks and issues raised by business and technology stakeholders.
• Analyze stakeholder input and translate complex or loosely defined concerns into clear, concise, well-structured risk statements.
• Assess risks using established likelihood, impact, severity, and risk-rating methodologies.
• Differentiate between risks, issues, findings, observations, and remediation actions.
• Assist risk owners in documenting risk impact, root causes, existing controls, mitigation strategies, and target remediation dates.
• Support initial and periodic risk assessments.
• Manage risks throughout the complete lifecycle, including identification, intake, assessment, documentation, risk rating, ownership assignment, remediation, monitoring, and closure.
• Ensure appropriate risk owners and remediation owners are assigned.
• Follow up with stakeholders on outstanding remediation actions and overdue items.
• Review supporting evidence before recommending risks or issues for closure.
• Maintain appropriate documentation and audit trails throughout the risk lifecycle.
• Escalate aging, overdue, or high-severity risks and issues when necessary.
• Partner with business, IT, cybersecurity, compliance, audit, and other risk stakeholders to gather information and maintain risk records.
• Facilitate stakeholder discussions to clarify risk scenarios, business impact, existing controls, and remediation plans.
• Communicate risk-related information clearly to technical and non-technical audiences.
• Support the preparation of risk reports, dashboards, status updates, and management reporting.
• Identify data-quality gaps and work with risk owners to resolve incomplete or inconsistent information.
Required Qualifications
• 5-7 years of experience in Risk Management, IT Risk, Enterprise Risk Management, GRC, Cybersecurity Risk, Compliance, or a related discipline.
• 5+ years of hands-on experience with ServiceNow IRM/GRC.
• 5+ years of demonstrated experience creating, updating, tracking, and maintaining risks and issues within the ServiceNow Risk Register.
• Strong understanding of the complete risk management lifecycle, including risk identification, assessment, documentation, remediation or mitigation, monitoring, risk acceptance, and closure.
• Ability to convert stakeholder discussions and input into clear, concise, and actionable risk statements.
• Experience documenting risk descriptions, impact, likelihood, risk ratings, ownership, mitigation plans, and remediation activities.
• Strong analytical and problem-solving skills.
• Excellent written and verbal communication skills.
• Strong attention to detail and the ability to maintain high-quality risk data.
• Ability to work independently and contribute effectively with minimal ramp-up.
• Recent hands-on experience with ServiceNow IRM/GRC, rather than experience limited to ServiceNow IT Service Management (ITSM).
Preferred Qualifications
• Experience with ServiceNow IRM/GRC Risk Management and Issue Management modules.
• Experience supporting IT, cybersecurity, operational, third-party, or enterprise risk programs.
• Understanding of risk and control frameworks such as NIST, ISO 27001, COBIT, COSO, or similar frameworks.
• Experience with risk dashboards, reporting, metrics, Key Risk Indicators (KRIs), and remediation tracking.
• ServiceNow IRM/GRC certification or a relevant risk management certification.
