Sr Data Risk Analyst

Burtch Works; New York (NY); Hybrid; USD 120,000 - 180,000; Full time

Job summary

Burtch Works seeks a Sr Data Risk Analyst in New York City to lead enterprise data risk initiatives within Data Governance and Data Risk Management. You will develop frameworks, metrics, and reporting to identify, assess, and monitor data-related risks.

The role partners with data owners, IT, Compliance, and Legal to translate technical findings into actionable risk insights, maintaining risk registers and KRIs while guiding remediation and governance activities in a hybrid environment.

Qualifications

• 5–8 years of professional experience in data governance, data risk management, or related risk disciplines.
• Experience developing, maintaining, or operationalizing risk frameworks, taxonomies, assessments, or risk registers.
• Hands-on experience defining and monitoring KRIs and KPIs, including thresholds, reporting methodologies, escalation criteria, and remediation tracking.
• Strong analytical skills to evaluate risk exposure, identify trends, assess control gaps, and communicate actionable findings.
• Experience using SQL, Tableau, Power BI, or comparable tools to analyze data and build risk dashboards and management reporting.
• Bachelor’s degree in Information Systems, Computer Science, Data Science, Business, Risk Management, or related field.
• Preferred: experience in financial services, insurance, or regulated industries; familiarity with GLBA, NYDFS Part 500, CCPA, or HIPAA; and data governance platforms.

Responsibilities

• Develop, maintain, and operationalize the enterprise data risk taxonomy, including risk categories, definitions, and assessment criteria.
• Support structured data risk assessments of data assets, processes, and platforms, evaluating inherent risk based on data sensitivity, business criticality, and exposure.
• Refresh residual risk scores using assessment results, control testing results, and metric trends, and rank risks by residual score to support prioritization.
• Provide input on control effectiveness and on how open control gaps affect the overall data risk level.
• Maintain the target-state control catalog and its mapping to the risk register.
• Support the review of risk appetite statements and tolerance thresholds, including preparing materials for appetite workshops.
• Align data risk practices with enterprise risk frameworks and applicable regulatory requirements, in partnership with Enterprise Risk Management, Compliance, and Legal.
• Identify emerging data risks and recurring control gaps, including risks from Generative AI, large language models, and model data.
• Define and operationalize data risk KRIs and KPIs, including metric definitions, thresholds, escalation triggers, ownership, and reporting methodologies.
• Maintain the enterprise data risk register, documenting risks, assessments, ownership, mitigation plans, and status.
• Evaluate the feasibility of sourcing candidate metrics and establish repeatable sourcing patterns that reduce manual effort in risk reporting.
• Analyze risk trends and concentrations, and build dashboards, scorecards, and management reporting on risk exposure, control gaps, and remediation progress.
• Translate complex technical findings into clear risk narratives for governance forums and senior management.

Skills

SQL

Tableau

Power BI

Education

Bachelor's degree

Job description

Sr Data Risk Analyst

Location: New York City (hybrid - 3 days)

Position: Sr Data Risk Analyst. Location: New York City (hybrid - 3 days). The Sr Data Risk Analyst advances the enterprise data risk management program by developing and maintaining the frameworks, metrics, reporting, and processes used to identify, assess, measure, monitor, and report data-related risks. As an individual contributor within the Data Governance and Data Risk Management function, this role supports the enterprise data risk framework, including the risk taxonomy, risk assessments, Key Risk Indicators (KRIs), Key Performance Indicators (KPIs), the data risk register, and remediation tracking. The analyst partners with data owners, stewards, technology teams, Enterprise Risk Management, Compliance, and other stakeholders to turn technical and operational data findings into actionable business risk insights.

Essential Duties & Responsibilities

Data Risk Framework and Assessment

• Develop, maintain, and operationalize the enterprise data risk taxonomy, including risk categories, definitions, and assessment criteria.
• Support structured data risk assessments of data assets, processes, and platforms, evaluating inherent risk based on data sensitivity, business criticality, and exposure.
• Refresh residual risk scores using assessment results, control testing results, and metric trends, and rank risks by residual score to support prioritization.
• Provide input on control effectiveness and on how open control gaps affect the overall data risk level.
• Maintain the target-state control catalog and its mapping to the risk register.
• Support the review of risk appetite statements and tolerance thresholds, including preparing materials for appetite workshops.
• Align data risk practices with enterprise risk frameworks and applicable regulatory requirements, in partnership with Enterprise Risk Management, Compliance, and Legal.
• Identify emerging data risks and recurring control gaps, including risks from Generative AI, large language models, and model data.

Risk Measurement, Monitoring, and Reporting

• Define and operationalize data risk KRIs and KPIs, including metric definitions, thresholds, escalation triggers, ownership, and reporting methodologies.
• Maintain the enterprise data risk register, documenting risks, assessments, ownership, mitigation plans, and status.
• Evaluate the feasibility of sourcing candidate metrics and establish repeatable sourcing patterns that reduce manual effort in risk reporting.
• Analyze risk trends and concentrations, and build dashboards, scorecards, and management reporting on risk exposure, control gaps, and remediation progress.
• Translate complex technical findings into clear risk narratives for governance forums and senior management, incorporating findings from data discovery, classification, protection, and quality tools.

Risk Mitigation and Remediation Oversight

• Track risks, control deficiencies, exceptions, and corrective actions through governance processes; set remediation priorities and target dates with risk owners.
• Monitor remediation progress, flag overdue or recurring issues, and escalation material risks per established processes.
• Support risk acceptance and exception management; track remediation evidence through governance processes.
• Document risk methodologies, data lineage for metrics, and operating procedures for risk reporting routines, and develop playbooks that promote consistent risk management practices.

Data Protection, Governance, and Stakeholder Engagement

• Partner with Data Protection Engineering, Cybersecurity, and Data Governance to assess risks from sensitive data exposure, classification gaps, data quality issues, and inadequate protection controls, and support risk-based prioritization of remediation.
• Support governance committees, risk forums, and management reviews with risk assessments, reporting, and recommendations.
• Build data risk awareness through guidance, training, roadshows, and onboarding sessions.
• Contribute to Agile delivery of data risk capabilities, including requirements, backlog prioritization, and stakeholder feedback.

Education, Experience, Competencies & Values

• 5–8 years of professional experience in data governance, data risk management, enterprise risk management, operational risk, or a related discipline.
• Experience developing, maintaining, or operationalizing risk frameworks, taxonomies, assessments, or risk registers.
• Hands-on experience defining and monitoring KRIs and KPIs, including thresholds, reporting methodologies, escalation criteria, and remediation tracking.
• Strong analytical skills to evaluate risk exposure, identify trends, assess control gaps, and communicate actionable findings.
• Experience using SQL, Tableau, Power BI, or comparable tools to analyze data and build risk dashboards and management reporting.
• Working knowledge of data governance concepts, including data quality, metadata management, data lineage, data classification, and data protection.
• Understanding of risk assessment methodologies, control effectiveness, issue management, and remediation processes.
• Strong communication, documentation, problem-solving, and stakeholder management skills, including experience engaging senior management and cross-functional teams.
• Bachelor’s degree in Information Systems, Computer Science, Data Science, Business, Risk Management, or a related field, or equivalent practical experience.
• Preferred: Experience in financial services, insurance, or a regulated industry; familiarity with GLBA, NYDFS Part 500, CCPA, or HIPAA; experience with DAMA‑DMBOK, DCAM, FAIR, or NIST CSF; familiarity with data governance platforms (Atlan, Collibra, Anomalo, Securiti.ai) and cloud platforms (AWS, GCP, Databricks); understanding of PII/PHI, masking, tokenization, and DSPM; experience with GRC platforms, Jira, Confluence, or Agile delivery; familiarity with AI and algorithmic data risk, including Generative AI and LLMs.