Senior Enterprise Risk Analyst (Remote From Anywhere In CO)

Senior Enterprise Risk Analyst (Remote From Anywhere In CO)

Salary

$110,000.00 - $120,000.00 Annually

Location

Statewide, CO

Job Type

Full Time

Job Number

EGB92761

Department

Governors Office of Information Technology

Opening Date

10/28/2026

Closing Date

11/8/2026 11:59 PM Mountain

FLSA

Determined by Position

Primary Physical Work Address

(Remote From Anywhere In CO)

FLSA Status

Exempt; position is not eligible for overtime compensation.

Department Contact Information

oit_hr@state.co.us

Type of Announcement

This announcement is not governed by the selection processes of the classified personnel system. Applications will be considered from residents and non-residents of Colorado.

How To Apply

Please submit an online application for this position at https://www.governmentjobs.com/careers/colorado. Reach out to the Department Contact to apply using a paper application, including any supplemental questions. Failure to submit a complete and timely application may result in the rejection of your application. Applicants are responsible for ensuring that application materials are received by the appropriate Human Resources office before the closing date and time listed.

• Description
• Benefits
• Questions

Department Information

Together, we innovate for a stronger Colorado

The work of employees at the Governors Office of Information Technology (OIT) is challenging and diverse because the needs of agencies, customers and Coloradans constantly evolve. But our focus never changes: improve the lives of all Coloradans through innovation and collaboration. Were building one of the nations leading government IT organizations by reimagining how we support agencies, building first-of-their-kind applications, and creating an inclusive, collaborative culture, together. Join us in the important work of providing equitable access to services.

Watch this video to learn more about how were Serving People. Serving Colorado.

Description of Job

IMPORTANT NOTE: Please review your application to ensure completion. For the most equitable applicant experience, OIT's hiring team considers only the contents of your application to review your qualifications. Please do not include any attachments (such as resume or cover letter) with your application as these items are not used by OIT's hiring team.

Would you like to secure and protect the digital infrastructure that keeps our state safe? At OIT, we build resilient security solutions to safeguard Coloradans first.

The Governors Office of Information Technology (OIT) is seeking a Senior Enterprise Risk Analyst to operationalize the enterprise risk management program across OIT and the state agencies it supports. In this role, you will translate established risk management methodology into defined processes, procedures, governance arrangements, and workflows connecting system-level risk assessments, the Enterprise Risk Register, remediation plans, policy exceptions, vendor and third-party risk, and enterprise risk reporting. You will establish standards for documenting, maintaining, and sharing risk information to ensure clear accountability, evidence traceability, and appropriate consideration of system-level findings in enterprise decisions.

Additionally, you will identify gaps in existing practices, drive workflow improvements and data requirements-including building out integration and automation through ServiceNow Integrated Risk Management (IRM)-and support the enterprise risk management roadmap to build a consistent, scalable, and evidence-based risk management capability across the organization.

Essential Functions:

• Risk Methodology and Process Implementation: Translate the established enterprise risk management methodology into practical procedures, guidance, templates, and workflows. Define how risks are identified, documented, assessed, prioritized, reviewed, and escalated, and how supporting processes operate consistently across OIT and the agencies it supports.

Outcome - Documented and repeatable risk management processes that support consistent implementation of the established methodology.

• Risk Assessment and Enterprise Risk Integration: Establish the processes that connect system-level risk assessments with the Enterprise Risk Register, remediation plans, policy exceptions, and enterprise risk reporting. Define how assessment findings, ownership, residual risk, and supporting evidence are recorded, linked, and escalated, working with technical risk specialists to preserve system-level context and identify material or systemic concerns. Analyze assessment findings, identify material risks and information gaps, and recommend risk priorities and actions.

Outcome - A traceable, evidence-based process for connecting system-level findings to enterprise risk decisions, with clear ownership, documented limitations, and actionable recommendations.

• Risk Governance and Accountability: Document and clarify risk management roles, responsibilities, decision rights, approval requirements, escalation paths and handoffs. Review relevant policies, standards, procedures and assurance activities to identify gaps or duplication, and recommend improvements to the Risk Standard and supporting guidance.

Outcome - Clearer governance arrangements and accountability for risk management decisions and activities.

• Risk Information and Reporting: Define information requirements, data ownership, evidence requirements, and refresh cycles for risk assessments, the Enterprise Risk Register, remediation activities, policy exceptions, and enterprise risk reporting. Identify data quality, availability, and integration gaps, and establish reporting requirements that support reliable, evidence-based risk analysis and decision-making.

Outcome - Defined information requirements and reliable, traceable risk information to support enterprise risk reporting and decision-making.

• Workflow Automation and Process Improvement: Analyze risk management processes to identify manual activities, duplication, bottlenecks and opportunities for automation. Translate established risk methodologies, policies and governance requirements into business rules, functional requirements and repeatable workflows, including through ServiceNow Integrated Risk Management (IRM). Collaborate with technical and data teams to design, test and refine automated processes, ensuring that workflows preserve required approvals, accountability, evidence and traceability.

Outcome - More efficient, consistent and traceable risk management workflows, with reduced manual effort and improved visibility of the enterprise risk management program.

• Risk Program Implementation and Continuous Improvement: Support implementation of the enterprise risk management roadmap by coordinating activities, tracking milestones and dependencies, identifying barriers and preparing recommendations for decisions. Evaluate the effectiveness of implemented processes and recommend improvements based on operational experience, assessment findings, audits, and evolving program requirements.

Outcome - Measurable progress in implementing and improving the enterprise risk management program.

Minimum Qualifications, Substitutions, Conditions of Employment & Appeal Rights

A wide salary range is posted for this position and any job offer is based upon a salary analysis to comply with the Colorado Equal Pay for Equal Work Act. The salary analysis considers relevant experience, education, certifications, and state seniority as compared to others doing substantially similar work. While all offers are compliant with the Colorado Equal Pay for Equal Work Act, there is no guarantee an offer will be at the top of the posted range based on the salary analysis.

This is a skills-based job announcement. The required minimum qualifications and/or education (if substituting for the proven experience, knowledge, and skills), are as follows:

Minimum Qualifications:

• At least five (5) years of professional experience in enterprise risk management, information security governance, IT compliance, IT audit, risk program implementation, or a related field.

• Demonstrated experience developing, implementing or improving risk management, compliance, audit or assurance processes, including procedures, governance arrangements, documentation and accountability mechanisms.

Substitutions:

• Additional appropriate education will substitute for the required experience on a year-for-year basis, but cannot completely substitute for these qualifications.

• Training or Certification related to the work assigned to the position will be assigned credit towards substitution for experience and/or education, but cannot completely substitute for these qualifications.

• If the minimum qualifications include a degree requirement, additional appropriate paid or unpaid experience will substitute for the required education on a year-for-year basis.

Preferred Qualifications:

• Demonstrated experience analyzing business processes and translating policy, regulatory, or program requirements into operational procedures, repeatable workflows, or system requirements.

• Demonstrated experience working across technical and business teams to implement processes, resolve issues, and support management decisions.

• Demonstrated experience analyzing business processes and translating policy, regulatory or program requirements into operational procedures, repeatable workflows or system requirements.

• Demonstrated experience using ServiceNow IRM or GRC tool.

• Demonstrated experience working across technical and business teams to implement processes, resolve issues and support management decisions.

• Relevant professional training or certifications, such as CISSP, CRISC or CISA, may receive substitution credit toward experience or education requirements but may not completely substitute for the required experience.

Conditions of Employment:

OIT employees must comply with any screening procedures in place at state agency locations where they might perform work.

A pre-employment background check will be conducted as part of the selection process. Post-employment background checks will be required for specific agencies as business needs dictate, which may include a polygraph exam, fingerprint-based criminal history search, reference checks, and a drug test.

This position may require travel within the specified geographic area, and to locations across the state as needed.

Supplemental Information

If this posting indicates "remote from anywhere in CO" in the title, periodic reporting to the primary state work location designated for the position is required. All remote work must be performed in Colorado.

While candidates from out of state will be considered for this role, the candidate selected for the position must relocate and reside in Colorado on the first day of their new position. A reasonable timeframe for relocation will be established on an individual basis, while considering business needs, and determining a start date.

We know its important to support each other, and that means having a healthy balance of work and personal time. Visit our benefits to learn more about some of our great offerings that allow us all to have fulfilling lives.

Visit our How to Apply webpage to learn more about our application process and what to expect after you apply.

The State of Colorado strives to create a Colorado for All by building and maintaining workplaces that value and respect all Coloradans through a commitment to equal opportunity and hiring based on merit and fitness. The State is resolute in non-discriminatory practices in everything we do, including hiring, employment, and advancement opportunities.

The Governors Office of Information Technology is committed to the full inclusion of all qualified individuals. As part of this commitment, our agency will assist individuals who have a disability with any reasonable accommodation requests related to employment, including completing the application process, interviewing, completing any pre-employment testing, participating in the employee selection process, and/or to perform essential job functions where the requested accommodation does not impose an undue hardship. If you have a disability and require reasonable accommodation to ensure you have a positive experience applying or interviewing for this position, please direct your inquiries to our ADA Coordinator at OIT_HR@state.co.us or call (303) 764-7900.

This posting may be used to fill multiple vacancies based upon business need.

The Governors Office of Information Technology does NOT offer sponsored Visas for employment purposes.

Please note that each agencys contact information is different; therefore, we encourage all applicants to view the full, official job announcement which includes contact information and class title. Select the job you wish to view, then click on the "Print" icon.

01

Which cybersecurity risk frameworks (e.g., NIST SP 800-53, ISO 27001, SOC 2, FAIR) have you actively implemented to assess and manage enterprise risk? Please detail your level of experience with each.

02

Detail your experience standing up a risk program, components of a risk program, or risk tool (i.e. risk assessment process, risk register process)?

03

Describe a time you developed, improved, or connected processes to make work more effective. What did you change, and what was the result?

04

Please describe how you learned of this job opening.

05

The Governors Office of Information Technology (OIT) complies with Colorados Equal Pay for Equal Work Act. While a wide salary range is posted, specific criteria (experience, education, state seniority, etc.) will be used to determine any salary offer. While most salary offers are made within the posted range, occasionally an offer is made below or above the posted range based upon this salary analysis. It is this salary analysis, rather than any negotiation process, that determines any salary offer.

• Yes, I acknowledge that it is to my benefit to include ALL of my RELEVANT experience in my application work history and I have done that here.
• No, I do not wish to include ALL of my RELEVANT experience, and I understand that this may affect a potential salary offer.

06

All remote work must be performed from within the State of Colorado. If you live out of state and are selected for this position you must relocate to Colorado before commencing employment. There is no form of relocation assistance, financial or otherwise, available for any position. Do you wish to proceed with your submission?

• Yes, I understand the above statement.

07

Do you currently reside in the state of Colorado?

• Yes
• No

08

If any of the State of Colorado positions listed in your employment history were performed as a contract employee, you MUST list the position/s, State Agency, and the name of the contracting company by whom you were paid during the contract position. If this does not apply, please type "N/A".

09

Do you currently require employer sponsorship for a Visa, employer-provided documentation to maintain your Visa, or employer participation in a program for the purposes of immigration status?

• Yes
• No

10

In the future, will you require employer sponsorship for a Visa, employer-provided documentation to maintain your Visa, or employer participation in a program for the purposes of immigration status?

• Yes
• No

Required Question

Employer State of Colorado

Address See the full announcement by clicking

the "Printer" icon located above the job title

Location varies by announcement, Colorado, --

Website https://careers.colorado.gov/