Tech Stack
Tag name is followed by "@" symbol and proficiency level value.
About proficiency levels:
- 1-2 — basic awareness. Minimal hands-on experience, and a rudimentary understanding of the technology's purpose;
- 3-6 — daily use. Comfortable and regular usage, capable of handling common tasks and challenges related to the technology;
- 7-9 — you are an expert, you can teach others, you know all the pitfalls and tricks;
- 10 — exceptional knowledge, comprehensive understanding, and adeptness in all aspects of the technology, including advanced problem-solving. Think twice before claiming or demanding such level.
AI
Audit
Reporting @ 6
Security
- 1-2 — basic awareness. Minimal hands-on experience, and a rudimentary understanding of the technology's purpose;
- 3-6 — daily use. Comfortable and regular usage, capable of handling common tasks and challenges related to the technology;
- 7-9 — you are an expert, you can teach others, you know all the pitfalls and tricks;
- 10 — exceptional knowledge, comprehensive understanding, and adeptness in all aspects of the technology, including advanced problem-solving. Think twice before claiming or demanding such level.
Details
Groq is seeking a Senior Operational Risk and Reporting Analyst to build GRC risk reporting into a continuous operation that communicates business impact to leadership rather than focusing solely on controls. The role also owns the third-party risk program, transforms annual risk exercises into a monthly operating rhythm, and tracks remediation across every framework in the program.
Responsibilities
- Build and run GRC risk reporting as a continuous operation, including intake, scoring against the risk methodology, treatment tracking, and risk acceptance with owners and expiry dates.
- Centralize risk data—including the risk register, key risk indicators, audit findings, and critical vendors—into dashboards for leadership use.
- Produce the monthly risk report for security leadership, framed by business impact rather than control count, with executive-ready commentary.
- Own the third-party risk program end to end, including vendor tiering, security assessments according to each tier's required cadence, review of vendor SOC 2 and ISO reports, remediation tracking, and clearing the vendor assessment control in the GRC tool.
- Track remediation across all frameworks so every open finding has an owner, date, and disposition, and report aging monthly.
Requirements
- 5+ years of experience in operational risk, IT risk, or GRC, including building and running risk assessment and reporting processes end to end in a regulated environment.
- Experience producing monthly risk reporting for risk committees and executives.
- Experience testing controls for effectiveness.
- Experience evaluating new initiatives for risk exposure before implementation, including third-party risk assessments.
- Experience with GRC tooling is preferred.
- Candidates for the U.S. posting must meet applicable U.S. export control eligibility requirements, including qualifying as a U.S. Person or being eligible for an applicable export license.
Compensation
The total cash salary range is $127,500–$172,500 per year, inclusive of potential bonus value. Individual placement depends on geographic location, experience, skills, and alignment with internal compensation standards. The range applies to candidates located in the United States. International compensation varies based on local market dynamics. Groq also offers a Long-Term Incentive Program and employee benefits.
Additional Information
Groq is an Equal Opportunity Employer committed to an inclusive environment and reasonable accommodations. Employment offers are contingent upon verification of identity and employment authorization. Groq may use artificial intelligence tools or automated systems to assist with recruiting and evaluation activities, subject to human review. Candidates may request reasonable accommodations, an alternative evaluation process, additional information about automated systems, or review of certain automated decisions.