Strategic GRC Risk Analyst

TikTok USDS Joint Venture; New York (NY); On-site; USD 99,000 - 196,000; Full time

Job summary

TikTok USDS Joint Venture LLC is seeking a GRC Risk Management Analyst to drive the risk register lifecycle, identify risks, assign ownership, and assess controls across stakeholders within the USDS Security governance program.

You will partner with cross-functional teams to mature risk reporting, support PIA processes, and help implement quantitative risk models, contributing to a risk-aware culture across the enterprise.

Qualifications

• 3+ years of experience in IT, Cyber, or Enterprise Risk Management in a fast-paced tech environment.
• Hands-on experience conducting risk assessments, executing risk registers, and tracking remediation plans.
• Familiarity with FAIR, NIST RMF, ISO 31000, or COBIT frameworks.

Responsibilities

• Partner with cross-functional business units to track, reduce, and mitigate security, privacy, and compliance risks.
• Support development and documentation of risk intake and analysis programs; draft operating procedures for collaboration with internal partners.
• Review internal/external data sources to identify trends and vectors of security/privacy risk for mitigation planning.
• Define internal/external risk signals and implement risk quantification models (e.g., FAIR) for data-driven outputs.
• Support Privacy Impact Assessments (PIAs) and privacy risk analysis; mature risk reporting (KPIs/KRIs) for leadership decisions.
• Drive automation in data collection/review to improve timely risk factor reviews; participate in special projects.

Skills

Risk management

Risk assessments

Stakeholder communications

KRIs/KPIs reporting

Cross-functional collaboration

Problem solving

Job description

TikTok USDS Joint Venture LLC is seeking a GRC Risk Management Analyst to drive the risk register lifecycle, identify risks, assign ownership, and assess controls across stakeholders within the USDS Security governance program.

You will partner with cross-functional teams to mature risk reporting, support PIA processes, and help implement quantitative risk models, contributing to a risk-aware culture across the enterprise.