Senior Risk Analyst, Information Security Risk Management (CO, Colombia, Virtual

免费注册后解锁"你的匹配分 vs 高分画像"与个人技能缺口。

Shape what's next with BCD Senior Risk Analyst, Information Security Risk Management Full time, Colombia, Costa Rica and Mexico The Senior Risk Analyst operates within the Information Security Risk Management Team and is a core contributor to BCD Travel ’s enterprise information security risk management program. The role is responsible for identifying, assessing, documenting, monitoring, and supporting the treatment of information security risks across business services, applications, technology environments, projects, and third-party suppliers. The position applies structured and standards-based risk methodologies to assess inherent and residual risk, identify control gaps, evaluate control effectiveness, recommend proportionate treatment options, and support informed risk decisions. The role works closely with business owners, technology teams, control owners, and governance functions to ensure risks are clearly understood, appropriately owned, and supported by informed, well-documented risk decisions and treatment actions. The Senior Risk Analyst maintains and continuously improves the centralized information security risk register, including the relationships between risk entries, security risk assessments, findings, projects, controls, exceptions, and remediation activities. The ideal candidate brings strong information security risk management experience, sound professional judgment, and a governance-first mindset, enabling them to contribute quickly with minimal oversight. What You'll Do Lead information security risk assessments covering applications, infrastructure, cloud services, business processes, projects, integrations, and third-party suppliers Determine inherent and residual risk ratings using approved criteria, documented evidence, and clear rationale Identify control gaps and evaluate the design, implementation, and effectiveness of security controls Develop clear risk statements and recommend practical risk treatment options that address business and security requirements Map risks and findings to internal policies, control procedures, regulatory requirements, and recognized security frameworks Partner with business and risk owners to develop remediation and risk treatment plans with defined actions, ownership, target dates, and expected residual risk outcomes Maintain and continuously improve the centralized information security risk register, ensuring risk ratings, ownership, treatment decisions, control mappings, and supporting evidence remain current and appropriate Conduct security risk assessments for new and existing third-party suppliers, including reviews of security assurance documentation, certifications, independent assessment reports, testing evidence, contractual requirements, and identified control gaps Assess risks associated with emerging technologies, including artificial intelligence, and provide guidance on governance, control considerations, and risk management requirements to support informed adoption and business decision-making Collaborate with Security, Privacy, Legal, Compliance, Audit, Technology, Procurement, Business Relationship Management, and business stakeholders to support informed and consistent risk decisions Prepare risk summaries, dashboards, metrics, and management reporting that communicate key exposures, treatment progress, emerging risks, overdue actions, and decisions requiring management attention Monitor changes in technology, business processes, suppliers, threats, vulnerabilities, regulatory requirements, and control environments, initiating reassessment activities when appropriate What You'll Bring Bachelor's degree in Information Security, Cybersecurity, Computer Science, Information Systems, Risk Management, Business, or related field, or equivalent experience Demonstrated experience conducting information security or technology risk assessments using structured risk management methodologies Strong understanding of information security risk concepts, includin

⚑ 岗位信息收录自公开招聘页（公开招聘平台），以雇主官网为准