Senior IT Risk Analyst

Working with Us Challenging. Meaningful. Life-changing. Those aren’t words that are usually associated with a job. But working at Bristol Myers Squibb is anything but usual. Here, uniquely interesting work happens every day, in every department. From optimizing a production line to the latest breakthroughs in cell therapy, this is work that transforms the lives of patients, and the careers of those who do it. You’ll get the chance to grow and thrive through opportunities uncommon in scale and scope, alongside high-achieving teams. Take your career farther than you thought possible. Bristol Myers Squibb recognizes the importance of balance and flexibility in our work environment. We offer a wide variety of competitive benefits, services and programs that provide our employees with the resources to pursue their goals, both at work and in their personal lives. Read more: careers.bms.com/working-with-us. Key Responsibilities Senior Risk Judgment & Advisory * Serve as the senior analytical authority for complex, high-tier risk cases — including Cyber Risk, AI risk, cross-jurisdictional privacy complexity, and novel technology types not clearly addressed by existing framework * Provide risk advisory support to IT leadership, BISOs, Legal/Privacy, and business stakeholders — translating complex risk landscapes into clear, actionable guidance * Own the integrity of the risk determination record for high-profile or sensitive programs; provide independent review where risk signals are ambiguous or where determinations carry material business or regulatory consequence * Guide analysts on when to accept, challenge, escalate, or override risk outputs — serving as a calibration resource and quality anchor for the team Framework Stewardship & Continuous Monitoring * Monitor patterns across risk assessments — override rates, exception volumes, flag frequencies — to identify systematic accuracy issues, framework gaps, or emerging risk themes * Support continuous monitoring initiatives and contribute to the evolution of BMS's integrated risk framework (Scope Screening → Regulatory Classification → Risk-Tiered Controls) as the operating model matures * Identify where the risk tiering model, control library, or assessment logic may need refinement; articulate improvement recommendations with supporting evidence to Risk Leads and leadership * Contribute to periodic reviews of auto-approved projects, leading structured assessments where findings may have broader programmatic implications Stakeholder Leadership & Cross-Functional Engagement * Lead engagement with senior project sponsors, IT architects, Legal/Privacy SMEs, and Compliance teams on high-risk or high-complexity assessments * Represent the IT Risk function in cross-functional forums; provide subject matter expertise on regulatory risk implications (GDPR, EU AI Act, GxP, NIST frameworks) * Build and maintain strong partnerships across IT, Legal, Privacy, Cybersecurity, and Business functions; act as a trusted advisor rather than a compliance gatekeeper * Support escalation resolution between Risk Leads, BISOs, Privacy SMEs, and project teams; facilitate closure on disputes involving risk determinations and framework interpretation Operational Excellence & Governance * Ensure audit-ready documentation standards across the team; review and validate complex SNOW and GRC records for accuracy, completeness, and audit defensibility * Contribute to or lead training initiatives for analysts on evolving framework components, updated risk tiering logic, and operational workflow changes * Support governance reporting; prepare executive-quality risk summaries, trend analyses, and control attestation packages for senior leadership and compliance audiences * Provide UAT support for framework and tooling updates — including validating that risk outputs align with expected SME-level determinations Mentorship & Team Development * Provide mentorship and guidance to junior...