Senior IT Risk Management Specialist

About the role

Marsh is looking for a Senior IT Risk Management Specialist based in Mexico City. This is a hybrid role with at least three days a week in the office. You will discover and catalog existing IT controls across the enterprise, turn technical implementations and documentation into clear, testable control statements and procedures, and maintain a centralized, auditable controls library mapped to NIST frameworks, corporate policy and applicable legal and regulatory requirements. You will also mentor a small team of controls specialists and partner with IT and business control owners.

Key responsibilities

• Identify existing controls through interviews, workshops and evidence reviews across infrastructure, applications, cloud, identity, change management and third-party services.
• Draft control statements and test procedures, including acceptance criteria and evidence requirements.
• Design and run an enterprise Control Self-Assessment (CSA) program, scoring control design effectiveness and evidence completeness, and managing CSA instances in GRC with auditable trails.
• Confirm controls with owners and auditors, then finalize control language for the repository.
• Prioritize and remediate gaps, recommending compensating controls and tracking remediation or formal exceptions.
• Mentor team members and run control identification playbooks and templates.

Required profile

• Undergraduate or graduate degree in IT Management, Computer Information Systems (CIS) or equivalent.
• Experience supporting audit objectives such as SOC 1, SOC 2, GS007 and SOX.
• Ability to articulate business and technical requirements to IT teams and business users, with strong communication and partnership skills.
• Ability to meet deadlines in a fast-paced environment; advanced English is required.

Required skills

• Knowledge of regulations affecting global IT organizations (e.g., Sarbanes-Oxley, NYDFS Cybersecurity Regulation, CPS 234, China PIPL).
• Knowledge of security frameworks including NIST CSF, NIST SP800-53 and ISO 27001.
• Significant experience with Microsoft Office Suite.