Senior Risk Analyst

At Bristol Myers Squibb, our employees often ask, “Who are you working for?”—a question that fuels collaboration, accountability, and urgency in our work. Our purpose-driven culture inspires us to discover, develop, and deliver innovative medicines to prevail over serious diseases. We offer uniquely interesting and meaningful work, opportunities for growth, and a supportive environment that values inclusion, wellbeing, flexibility, and comprehensive benefits. This is work that transforms the lives of patients, and the careers of those who do it. Key Responsibilities Senior Risk Judgment & Advisory Serve as the senior analytical authority for complex, high-tier risk cases — including Cyber Risk, AI risk, cross-jurisdictional privacy complexity, and novel technology types not clearly addressed by existing framework Provide risk advisory support to IT leadership, BISOs, Legal/Privacy, and business stakeholders — translating complex risk landscapes into clear, actionable guidance Own the integrity of the risk determination record for high-profile or sensitive programs; provide independent review where risk signals are ambiguous or where determinations carry material business or regulatory consequence Guide analysts on when to accept, challenge, escalate, or override risk outputs — serving as a calibration resource and quality anchor for the team Framework Stewardship & Continuous Monitoring Monitor patterns across risk assessments — override rates, exception volumes, flag frequencies — to identify systematic accuracy issues, framework gaps, or emerging risk themes Support continuous monitoring initiatives and contribute to the evolution of BMS's integrated risk framework (Scope Screening → Regulatory Classification → Risk-Tiered Controls) as the operating model matures Identify where the risk tiering model, control library, or assessment logic may need refinement; articulate improvement recommendations with supporting evidence to Risk Leads and leadership Contribute to periodic reviews of auto-approved projects, leading structured assessments where findings may have broader programmatic implications Stakeholder Leadership & Cross-Functional Engagement Lead engagement with senior project sponsors, IT architects, Legal/Privacy SMEs, and Compliance teams on high-risk or high-complexity assessments Represent the IT Risk function in cross-functional forums; provide subject matter expertise on regulatory risk implications (GDPR, EU AI Act, GxP, NIST frameworks) Build and maintain strong partnerships across IT, Legal, Privacy, Cybersecurity, and Business functions; act as a trusted advisor rather than a compliance gatekeeper Support escalation resolution between Risk Leads, BISOs, Privacy SMEs, and project teams; facilitate closure on disputes involving risk determinations and framework interpretation Operational Excellence & Governance