Global Information Risk & Governance Analyst

Mars; Guararema; Presencial; BRL 120 000 - 180 000; Tempo integral

Resumo da oferta

Mars is seeking a Global Information Risk & Governance Analyst to manage the end-to-end risk management program, policy lifecycle, and compliance across the organization. You will partner with risk owners, assess threats, and present insights to senior leaders.

The role requires experience in GRC or IT risk, strong communication, and ability to drive cross-functional initiatives. This is a global, individual contributor position within a broader risk management team.

Qualificações

• Bachelor’s degree in information security, IT, or equivalent.
• Experience in Information Security GRC or IT Risk or Governance.
• Strong communication and presentation skills for executive materials.
• Familiarity with the NIST CSF or similar frameworks.
• Proven ability to manage multiple projects and priorities.

Responsabilidades

• Partner with risk owners to document, assign, and track remediation plans.
• Apply formal risk rating methodology for consistent prioritization.
• Embed end-to-end risk management in the business area.
• Deliver analyses to generate actionable insights into risk trends.
• Drive process improvements and lead initiatives end-to-end.
• Monitor regulatory changes and update policy lifecycle accordingly.
• Manage policy exception processes with formal risk-based decisions.
• Investigate non-compliance and perform policy attestations.
• Maintain KRIs and KPIs for executive reporting.

Conhecimentos

Information Security

GRC

Risk Management

Stakeholder Management

Communication

Executive reporting

Formação académica

Bachelor’s degree in information security or IT

Ferramentas

GRC software

Descrição da oferta de emprego

Job Description

As the Global Information Risk & Governance Analyst, you will manage the end-to-end risk management program and policy lifecycle. In this role, you will lead risk assessments and govern the identification, assessment, and response to security risks. Additionally, you will be responsible for the development, maintenance, and compliance of security policies and standards.

What are we looking for?

The position is an individual contributor role but is part of a global team. Risks are submitted via the GRC reporting system and the results of proactive top-down risk assessments. This role will work closely with different risk owners from Mars businesses to support risk remediation end-to-end. Insights from risk management are presented and prepared for the Risk Director, who distributes results to various committees and senior executive teams.

What will be your key responsibilities?

• Partner with risk owners across the business to document, assign, and track risk remediation plans through their lifecycle.
• Apply formal risk rating methodology to ensure consistent, accurate, and repeatable risk prioritization.
• Embed and support end-to-end risk management services in assigned area of the business (risk identification, assessment, and issue management).
• Deliver comprehensive analysis of risk data to generate actionable insights.
• Drive process optimization by identifying continuous improvement opportunities and leading initiatives from concept to execution.
• Develop and implement processes to ensure organizational compliance by monitoring changes to external regulations and standards, performing periodic gap assessments, and integrating necessary updates into the policy lifecycle.
• Operate the Policy Exception Management Process, aligning with key technical and business teams to evaluate and decide on exception requests using a formal, risk-based approach.
• Execute the policy attestation process and investigate non-compliance.
• Maintain and monitor KRI/KPIs to reflect risk trends, policy compliance, and executive-level reporting.

What are we looking for?

• 1. Education & Professional Qualification
  • Bachelor’s degree in information security, IT, or a similar field, or equivalent work experience
  • Experience in Information Security GRC or IT Risk or Governance role
• 2. Knowledge/Experience
  • Familiarity with Risk Management, Issue Management, Information Security, and GRC practices.
  • Strong follow-through, execution, and attention to detail within a complex environment across multiple, diverse stakeholders.
  • Excellent communication and presentation skills, with a proven ability to create executive-level materials.
  • Familiarity with the NIST Cybersecurity Framework (CSF) or other industry-standard security frameworks.
  • Proven ability to set and achieve goals and manage multiple projects and priorities.