We are looking for an IT Risk & GRC Specialist to join our Information Security team. This role is focused on IT risk management, governance, compliance, and control frameworks, supporting the alignment of technology risks and controls with internal policies, industry standards, and regulatory requirements.

What you will do

- Support and enhance IT Risk, Governance, Risk & Compliance, and control frameworks.
- Perform risk and control assessments and identify potential control gaps and improvement opportunities.
- Evaluate the effectiveness of IT and Information Security controls.
- Map internal controls against security policies, standards, industry frameworks, and regulatory requirements.
- Support the alignment of risks, controls, policies, and compliance requirements.
- Monitor industry trends, emerging risks, and regulatory changes to recommend improvements.
- Work closely with integral teams across Information Security, Risk, Compliance, IT Audit, Technology, and Legal.
- Support the implementation and use of GRC tools and platforms.




- Maintain documentation related to risks, controls, policies, processes, and methodologies.

What we are looking for
- 3–5 years of experience in IT Risk Management, Technology Risk, GRC, IT Controls, IT Audit, Information Security Governance, Security Compliance, or related areas.
- Experience with risk assessments, control assessments, control testing, gap analysis, and/or IT General Controls.
- Knowledge and practical experience with industry standards and control frameworks such as:
- ISO / ISO 27001
- NIST
- COBIT
- PCI DSS
- Knowledge of regulatory and compliance requirements such as SOX, GDPR, DORA, or similar regulations.
- Experience interpreting and applying risk, policy, control, and regulatory requirements within technology environments.
- Familiarity with GRC platforms such as Archer/RSA Archer or similar tools.
- Advanced English proficiency, both written and verbal.

📌 IT Risk Analyst (Miguel Hidalgo)
🏢 EY GDS CS MEXICO
📍 Miguel Hidalgo