Analyst, Cybersecurity and Compliance

White & Case LLP•Tampa, FL

About The Position

The Analyst, Cybersecurity & Compliance assists the Senior Analyst, Cybersecurity & Compliance in protecting the Firm against cybersecurity threats. The role helps identify, evaluate, and monitor cybersecurity risks and collaborates with teams across the Firm to manage Governance, Risk Management, and Compliance (GRC) areas, including audits, information security certifications, and vendor management risks. The work supports adherence to industry and cybersecurity standards and applicable client and government regulations. The Analyst helps stakeholders incorporate security measures into business operations, system designs, and software development processes. The role also assists in enhancing and implementing processes for planning remediation strategies that support compliance with policies and regulations. It provides insights for risk prioritization and prepares reports on trends, risk levels, and metrics, while fostering cross-functional partnerships and awareness to support effective cybersecurity controls across the Firm.

Requirements

At least 3 years of experience within GRC, specifically in vendor intake processes or risk management standards and frameworks.
Possess or be working toward a cybersecurity certification such as CRISC, CISM, CGEIT, CISA, or CISSP.
Understand industry standards, certifications, and regulations, including NIST 800-53, CSF 2.0, and ISO 27001.
Have working knowledge of compliance programs related to SSAE16 SOC1, SOC2, and PCI.
Have basic-to-intermediate knowledge of a GRC tool such as Vanta, Drata, ServiceNow GRC, OneTrust, or C1Risk.
Review Secure SDLC life cycle assessments.
Have working knowledge of enterprise infrastructure and application monitoring tools.
Be proficient in Microsoft Office applications, with subject matter expertise in Excel, Power BI, databases, dashboarding tools, and data manipulation.
Demonstrate attention to detail and clear, logical, analytical thinking.
Be able to prioritize and manage multiple tasks under pressure.
Have good verbal, written, and numeric skills.
Be able to travel or work overtime as needed.

Responsibilities

Assist the Senior Analyst with GRC management principles and practices.
Support planned and ad hoc internal assessments and audits to evaluate and validate the design and operational effectiveness of technical and administrative controls.
Monitor open internal and external audit items and coordinate audit evidence collection to support completion of remediation activities in agreed action plans and risk treatment plans.
Produce operational compliance and risk reports covering control completion, evidence freshness, overdue items, and remediation SLAs, and communicate trends to stakeholders.
Identify and implement opportunities to automate manual GRC processes using tools such as Microsoft Copilot and Power Platform.
Administer GRC tools at a basic-to-intermediate level, maintaining control libraries, evidence repositories, workflows, user access, templates, and assignments.
Maintain and prioritize an actionable risk register, including clear risk statements, likelihood and impact scores, owners, and remediation plans aligned with business priorities.
Support the Firm’s business resiliency program through business impact analyses, disaster recovery exercises, business continuity plan updates, lessons-learned documentation, and tracking follow-up actions.
Partner with Technology teams to define processes that meet control intent while fitting delivery practices, including CI/CD approvals, IaC reviews, and incident response workflows.
Coordinate third-party risk activities with Legal, Privacy, and Procurement, including due diligence intake calls, documenting risks, and following up with stakeholders, vendors, and Legal.
Convert identified third-party risks into MSA mitigation clauses for parties handling sensitive data or providing critical services.
Support the security awareness and training program by developing role-based courses, conducting quarterly phishing simulations, preparing management reports, and contributing to awareness content and communications.
Design, manage, and update company compliance documentation and reports.
Create road maps for regulatory compliance as needed.