Technology Risk & Continuity Analyst

Company Profile   Founded in 1977, GMO is a global investment manager committed to delivering superior long-term investment performance and advice to our clients. We offer investment strategies and solutions where we believe we are positioned to add the greatest value for our investors. These include multi-asset class, equity, fixed income and alternative offerings.   We manage approximately $80bn for a client base that includes many of the world’s most sophisticated institutions, financial intermediaries, and private clients. Industry-wide, we are well known for our focus on valuation-based investing, willingness to take bold positions when conditions warrant, and candid and academically rigorous thought leadership. Jeremy Grantham, GMO’s Co-Founder and Long-Term Investment Strategist, is renowned as an expert in identifying speculative investment bubbles and also as a leading climate investor and advocate.   GMO is privately owned and employs over 430 people worldwide. We are headquartered in Boston, with additional offices in Europe, Asia and Australia. Our company-wide culture emphasizes commitment to clients, intellectual curiosity, and open debate. We celebrate and respect our differences, while embracing and valuing what each of us brings to work, as we know that diverse teams in an inclusive, caring environment achieve higher engagement and better client results.   Please follow the prompts included in this job posting to apply. The application window for this role is anticipated to remain open until the job is filled, or as otherwise determined by GMO.   Overview: As a key member of the Security Risk & Audit team, the Technology Risk & Continuity Analyst supports the firm’s security risk, business continuity, and incident management programs, contributing across prevention, preparedness, and response activities. This role performs core security risk functions such as risk and control support, audit readiness, access review coordination, and security awareness enablement. It also supports the development, maintenance, and testing of business continuity and incident response plans, including coordinating exercises and tracking remediation activities. The analyst monitors threats and incidents, supports resilience and training platforms, and contributes to audit and due diligence efforts. Working closely with technology, risk, and business stakeholders, this role provides broad organizational exposure while helping ensure the firm is prepared for operational disruptions and cyber events, and continually improving its security posture. We value individuals who are reliable, curious, collaborative, proactive, and strong communicators—professionals who enjoy problem-solving and are eager to build hands-on experience across security risk management, continuity planning, and incident management. Primary Responsibilities: Business Continuity Work with all areas of the firm to map critical service dependencies and document recovery strategies through the BIA process, gathering recovery requirements, and identifying single points of failure Support maintenance of Business Continuity and Incident Response Plans through regular reviews and exercises, with a focus on continuous improvement Maintain program documentation including incident and exercise reporting, program metrics and reports for a variety of stakeholders Develop and maintain BCP standards and templates. Participate in Business Continuity and risk forums Identify emerging risks (e.g., regulatory changes, natural and man-made risk) and perform risk assessments. Administer and maintain the Riskonnect Resilience platform including monitoring platform updates, attending vendor training, and managing the vendor relationship Security & Risk Management Monitor IT incidents and document significant events Prepare incident summaries for internal tracking and reporting Coordinate security awareness programs via Learning Pool, including onboarding, annual training, and phishing simulations Support internal and external audits by collecting evidence, documenting control activities, and maintaining audit artifacts Assist with annual program reviews and audit readiness activities Respond to client due diligence requests and RFPs, leveraging knowledge bases and SMEs as needed Participate in vendor risk assessments, onboarding reviews, and ongoing monitoring of critical vendors