What we need

The Senior Information Risk Analyst is a risk management professional, a versatile technical risk and information security expert, and a highly valued partner within the Information Risk Management (IRM) team. In this role, you will evaluate the organization's technology risk posture by conducting objective, fact-based assessments of existing and emerging third parties, systems, and applications. By analyzing these findings through a pragmatic, risk-based framework, you will partner directly with business stakeholders to design practical mitigation strategies that align with the organization's overall risk tolerance and business objectives. A critical component of this position involves translating complex technology and digital threats into clear, actionable business insights.

This position is open to candidates based in Massachusetts as well as remote, US-based candidates.

Your Day to Day

• Perform vendor risk assessments to identify, evaluate and communicate risks to ensure they are properly understood and managed in alignment with organizational risk appetite, as well as applicable legal, regulatory, contractual and organizational requirements throughout the lifecycle of the relationship with the vendor.
• Function as a technology risk subject matter expert; possess a strong technical understanding of infrastructure resiliency, secure data transmission protocols, network architecture, and modern threat vectors.
• Execute thorough and timely technology risk assessments, including compliance risk, AI risk, application risk, and other analyses, across applications, initiatives, and business processes.
• Evaluate contractual protection documentation to ensure vendor agreements mitigate compliance, regulatory, and data risk, mandate appropriate technical and administrative safeguards that protect BCBSMA data within established risk tolerances.
• Partner with Legal and Procurement teams to guide negotiations on contract language and mitigation strategies, bringing third-party risk to acceptable levels.
• Translate complex HIPAA regulatory requirements and risk mitigations into plain language and guide business units in the implementation of appropriate data safeguarding strategies, ensuring compliance is achieved through practical, risk-based solutions.
• Distill complex risk data into high-impact executive dashboards and advanced visual reports for senior leadership with a clear, quantitative understanding of the risk landscape.
• Serve as a trusted risk advisor and consultant to business units, partnering with them during the development and coordination of business processes and systems to proactively embed risk management strategies.
• Actively engage with business units to gain foresight into upcoming initiatives, ensuring technology risks are proactively managed and embedded from the planning phase.
• Contribute expert-level guidance to cross-functional teams in the development of risk, compliance, and information protection policies, standards, and procedures.
• Drive the regular review and enhancement of governance documents to ensure they remain practical, relevant, and aligned with our evolving business needs.
• Lead targeted internal initiatives and process improvements as directed by leadership to help optimize the team's advisory capabilities and overall risk delivery framework.

This document is not an exhaustive list of all responsibilities, skills, duties, requirements, or working conditions associated with the job. Employees may be required to perform other job-related duties.

We're Looking for:

• In addition to third-party risk management or a cybersecurity generalist, expertise in one or more of the following: risk management, regulatory compliance, application risk analysis, data analytics, and visualizations.
• Solutions-oriented business partner, leveraging a deep understanding of technical defense concepts, vulnerability landscapes, and system safeguard principles.
• Strong personal drive, organization and execution skills, and ability to self-manage to a defined outcome, including project decomposition, task identification, leadership alignment, regular status points, and successful on-time completion.
• Collaborator who develops and champions practical risk mitigation strategies rather than rigid technical blockers.
• Ability to analyze and translate complex technical findings into clear, actionable business contexts, working collaboratively with stakeholders to mitigate risk and enable risk informed executive decisions
• Experience assisting in the development and tracking of Key Risk Indicators (KRIs) and performance metrics to continuously monitor the health of the third-party ecosystem and the broader technology risk program.
• Strong interpersonal skills to cultivate relationships and foster cross-team collaboration across the enterprise
• Ability to serve as a mentor to team members, providing peer guidance, operational support, and coaching on technology risk management strategies and assessment processes.

What You Bring:

• BA or BS degree in Risk Management, Technology, Business Administration, Information Security, a related field, or equivalent practical experience.
• 8+ years of experience in third-party risk management, technology, IT, or risk management functions.
• 5+ years of dedicated experience executing risk assessments, vendor evaluations, or risk management programs within an information protection framework.
• CRISC, CTPRP (Certified Third-Party Risk Professional), or C3PRMP strongly preferred.
• Demonstrated experience navigating healthcare regulatory and compliance frameworks, specifically HIPAA and HITRUST.
• Hands-on experience utilizing enterprise GRC platforms and Third-Party Risk Management tools (e.g., Whistic, RiskRecon, ServiceNow, or similar).
• Relevant audit, general GRC, or high-level protection certifications are a plus (e.g., CISSP, CISA, GRCP, CGRC, CISM).

What You'll Gain:

The Senior Information Risk Analyst plays a vital role in executing the organization's third-party risk management program. This includes leading the evaluation of technology risks associated with our vendor ecosystem, driving the negotiation of contractual protection requirements, monitoring the remediation of identified vulnerabilities, and conducting ongoing risk alignment assessments of BCBSMA applications and data

As a member of a highly collaborative team of seasoned analysts, you will act as a strategic advisor to cross-functional partners across Legal, Privacy, Audit, Information Security, Procurement, Vendor Management, and Account teams. By championing a risk-based approach, you will help safeguard the confidentiality and integrity of BCBSMA information, ensuring that our digital risk posture supports and enables business initiatives rather than hindering them. As a subject matter expert, you will actively shape the policies, standards, and procedures that govern our third-party and information risk landscape and be instrumental in the continuous maturity of the Information Risk Management team.

Minimum Education Requirements:

High school degree or equivalent required unless otherwise noted above

Location
BostonTime Type
Full time

Salary Range: $110,970.00 - $135,630.00

The job posting range is the lowest to highest salary we in good faith believe we would pay for this role at the time of this posting. We may ultimately pay more or less than the posted range, and the range may be modified in the future. An employee's pay position within the salary range will be based on several factors including, but limited to, relevant education, qualifications, certifications, experience, skills, performance, shift, travel requirements, sales or revenue-based metrics, and business or organizational needs and affordability.

This job is also eligible for variable pay.

We offer comprehensive package of benefits including paid time off, medical/dental/vision insurance, 401(k), and a suite of well-being benefits to eligible employees.

Note: No amount of pay is considered to be wages or compensation until such amount is earned, vested, and determinable. The amount and availability of any bonus, commission, or any other form of compensation that are allocable to a particular employee remains in the Company's sole discretion unless and until paid and may be modified at the Company's sole discretion, consistent with the law.