[Hiring] Senior Risk Analyst @AlphaSense India

Role Description

AlphaSense is maturing its security risk management program and needs a Senior Risk Analyst to be a core builder and operator of that function. You will design, implement, and mature a risk framework that spans information security, AI, and operational risk—building toward a program that is quantitative-leaning, connected to live data sources, and actionable at every altitude from service owner to executive leadership. You will establish risk identification and scoring methodologies, own the enterprise risk register, and produce risk intelligence that drives real decisions. You will also support the TPRM function led by a dedicated TPRM lead, contributing to assessments and risk tracking as needed. You approach this with an AI-native mindset: using AI to monitor threat landscapes, analyze risk data, draft risk narratives, and surface emerging risks faster than a traditional manual program could. The goal is a risk function, not a risk register—one that measures outcomes and reduced exposure, not just activity.

This is not a role for someone looking to maintain a program that already exists. AlphaSense is building a risk management discipline that we believe can serve as the blueprint for how AI-era companies measure, communicate, and act on risk. Risk management across the industry is still largely qualitative, reactive, and disconnected from the systems that generate real signal. We intend to change that—and we want someone on this team who shares that ambition and wants to be part of building the model that others will eventually follow.

Key Responsibilities

• Risk Program Design & Maturation: Design and implement a structured risk management program, including risk taxonomy, scoring methodology, risk appetite statements, and escalation thresholds. Align the program with ISO 27005, NIST RMF, or ISO 31000 as appropriate.
• Risk Register Ownership: Build and maintain the enterprise risk register as a living operational tool. Lead periodic risk identification workshops with business, engineering, and legal stakeholders to surface new and evolving risks.
• AI-Augmented Risk Analysis: Leverage AI tools to monitor threat intelligence, identify patterns across risk data, accelerate risk narrative drafting, and keep the risk register current between formal review cycles.
• Third-Party & Vendor Risk Support: Support the TPRM function in partnership with the dedicated TPRM lead. Contribute to vendor risk assessments, risk scoring, and finding documentation as needed.
• AI & Emerging Technology Risk: Identify and assess AI-related risks including data privacy, model bias, explainability, security misuse, agentic system behavior, and third-party AI dependencies.
• Risk Reporting & Executive Communication: Produce clear, executive-ready risk reports, dashboards, and periodic risk summaries. Translate technical risk findings into business impact language.
• Cross-Functional Risk Advisory: Provide cross-functional risk and control guidance on process improvements, new technology adoption, post-implementation reviews, and remediation activities.

What Success Looks Like

• Security and compliance controls are clearly documented, tested, and consistently implemented.
• Risks and compliance gaps are identified early, tracked with owners, and remediated in partnership with technical teams.
• GRC processes scale alongside platform growth and new customer or regulatory requirements.
• Stakeholders across Engineering, Legal, and Product view the GRC function as a trusted, enabling partner.
• AI tools are used deliberately and responsibly.
• The risk register is a live operational tool that reflects current exposure.
• Risk reporting is driven by KRIs and live data sources.

Qualifications

• 6+ years of experience in GRC, information security, risk management, or IT audit, preferably in a SaaS or cloud-native environment.
• Strong understanding of security and compliance frameworks including SOC 2, ISO 27001, NIST CSF 2.0, and CIS Controls.
• AI-native mindset: you use AI tools for real, substantive work.
• Proficiency with GRC platforms for evidence management and control testing.
• Familiarity with cloud environments (AWS, Azure, or GCP).
• Experience supporting external audits across security or privacy domains.
• Ability to interpret technical controls and translate findings into compliance, risk, and policy documentation.
• Working knowledge of risk registers, control libraries, and policy governance lifecycles.
• Strong written communication, analytical thinking, and attention to detail.
• 4+ years of hands-on experience in information security risk management or a combined GRC/risk role.
• Demonstrated use of AI or data tools to surface risk insights.
• Proven experience maturing an organization's risk program from qualitative to quantitative risk measurement.
• Experience with data warehousing concepts, KRI development and tracking.
• Strong analytical skills.
• Experience producing executive-ready risk reports.
• Experience supporting TPRM assessments.

Nice to Have

• Relevant certifications: CISA, CRISC, CISM, CISSP, CCSK, or ISO 27001 Lead Auditor/Implementer.
• Experience with AI governance frameworks.
• Exposure to SOX ITGC cycles.
• Privacy program crossover: data mapping, DPIAs, GDPR/CCPA operational compliance.
• Scripting or automation experience applied to GRC or compliance workflows.
• Quantitative risk experience.
• Experience with AI risk domains.
• Familiarity with risk aggregation and BI tooling for risk dashboarding.
• Background in financial services regulatory risk environments.