IT Enterprise Risk Senior Analyst

Holland & Knight LLP•Tampa, FL

About The Position

The IT Enterprise Risk Senior Analyst helps manage the Firm’s GRC and IT risk by identifying and handling security risks across systems, processes, cloud services, and third parties, with a focus on protecting confidential information. The role works with attorneys, Risk Management, the Office of the General Counsel, and technology teams to maintain policies, conduct risk assessments, coordinate third-party security reviews, respond to client Outside Counsel Guidelines (OCGs) and audits, support assurance initiatives and cyber insurance, and deliver risk reporting for leadership. Activities align with standards and regulations including ISO/IEC 27001/27002, NIST CSF and SP 800-171, CIS Controls, SOC 2, HIPAA, GLBA, GDPR, and applicable state privacy laws such as CCPA/CPRA. The position leads policy governance and complex risk assessments, maintains the risk register, supports remediation and risk monitoring, and contributes to the Firm’s GRC operating model and roadmap. It also leads third-party security due diligence, client security questionnaire and OCG responses, audit and assurance coordination, control testing, and risk and control work for CUI and other regulated client data. The role supports leadership reporting, incident-related risk analysis, cyber insurance renewals, and applicable EU-aligned compliance activities. The position may be based at the Firm’s global operations center in the Tampa Bay area or its Dallas office. It requires a regular and predictable work schedule and full attention to work activities during business hours unless otherwise approved or required by applicable law. Physical requirements include sitting or standing for extended periods and moderate or advanced keyboard use.

Requirements

Bachelor’s degree in information security, Information Technology, Risk Management, Business, or equivalent practical experience.
At least 5 years of experience in GRC, information security, technology risk management, compliance, internal audit, or third-party risk management.
Working knowledge of ISO/IEC 27000 Family concepts, NIST CSF, NIST SP 800-53 or SP 800-171, and HIPAA.
Demonstrated experience collecting, organizing, and validating control evidence and leading audit or assessment support activities.
Strong written and verbal communication skills, including the ability to translate control requirements into clear documentation, actionable guidance, and leadership-ready reporting.
Strong organizational skills and attention to detail, with the ability to manage multiple priorities independently, exercise sound judgment, and influence business and technology stakeholders.
Knowledge of or ability to learn Microsoft Office Suite or Microsoft 365.
Familiarity with EU information security and privacy requirements, such as GDPR security principles.
Familiarity with legal-industry technology and its data-sensitivity considerations, including document management, time and billing, conflicts and new business intake, and eDiscovery platforms.
Awareness of ABA Model Rules of Professional Conduct, particularly Rules 1.1 and 1.6, and applicable state bar requirements concerning technology competence and client confidentiality.
Hands-on experience with one or more GRC platforms and questionnaire-automation tooling.
Ability to operate autonomously in a maturing program, contribute to GRC operating-model design, and mentor junior analysts as the team scales.
Ability to sit or stand for extended periods of time.
Moderate or advanced keyboard usage.

Nice To Haves

Prior experience supporting GRC, IT risk, or information security functions in a law firm, professional services firm, or other client-confidential environment is strongly preferred.
Familiarity with NIS2 is a plus where relevant.
Working knowledge of CUI handling requirements, NIST SP 800-171, CMMC Level 2, ITAR/EAR export-control data restrictions, and FedRAMP-aligned cloud usage.
Prior support of federal, defense, or government-contracts client matters is strongly preferred.
Familiarity with legal-industry platforms such as iManage or NetDocuments, 3E or Aderant, Intapp, and Relativity.
Experience with GRC platforms such as Archer, ServiceNow GRC, AuditBoard, or OneTrust, and questionnaire-automation tools such as ProcessUnity or Whistic.

Responsibilities

Lead the development, review, and maintenance of information security and technology risk policies, standards, procedures, and guidance documents.
Own the policy lifecycle, including stakeholder reviews, approvals, publication, periodic review schedules, and version control.
Map policies and standards to applicable security, privacy, regulatory, and client requirements; maintain crosswalks and control documentation for audit readiness and control maturity.
Administer policy exception and risk acceptance workflows, ensuring appropriate justification, compensating controls, approvals, and expiration or renewal dates.
Provide guidance and awareness materials to support consistent implementation of policy and control requirements.
Partner with the Office of the General Counsel, Conflicts, and Records & Information Governance on controls for ethical walls, information barriers, matter-level access restrictions, and legal holds.
Keep information security policies and standards consistent with professional responsibility obligations, including ABA Model Rules 1.1 and 1.6 and applicable state bar requirements.
Lead complex risk assessments for applications, infrastructure, cloud services, legal-industry platforms, and key business processes; document risk statements, likelihood, impact, and control effectiveness.
Maintain and enhance the risk register, including inherent and residual ratings, treatment plans, owners, milestones, and status reporting.
Work with control owners and business stakeholders to define remediation actions, monitor progress, and validate closure with evidence.
Support ongoing risk monitoring using key risk indicators, control health metrics, trend analysis, and identification of emerging legal-sector risks.
Prepare risk and control reports for senior technology, firm management, risk management, and audit committee audiences, translating technical findings into business and client-impact language.
Provide risk and control-failure analysis for incident response, contribute to post-incident lessons learned, and track resulting control improvements.
Contribute to the design and maturation of the Firm’s GRC operating model, processes, tooling, strategy, and roadmap.
Lead third-party security due diligence based on vendor criticality and risk tiering; coordinate questionnaires, evidence collection, and stakeholder reviews.
Manage the Firm-as-vendor response process, including client security questionnaires, OCG attestations, evidence packages, assurance materials, and client-led security audits.
Review vendor assurance artifacts, identify gaps, recommend remediation or compensating controls, and track vendor action plans to closure.
Partner with Procurement, Legal, and business owners to support appropriate security and privacy contract terms.
Lead periodic vendor reassessments and reviews triggered by scope changes, incidents, control concerns, or material service updates.
Coordinate internal and external audits and client-led security reviews, including evidence collection, control walkthroughs, stakeholder responses, and timely closure of requests.
Own the inbound client security questionnaire and OCG-response pipeline, including request triage, accurate responses, controlled answer-library maintenance, and coordination on client commitments and exceptions.
Support the annual cyber insurance application and renewal process by preparing attestations, evidence packages, and responses to underwriter and broker inquiries.
Perform and lead gap assessments and control testing against applicable security, privacy, and regulatory frameworks.
Lead the risk and control program for CUI and other regulated client data, including relevant NIST SP 800-171, CMMC Level 2, ITAR/EAR, and FedRAMP-aligned cloud requirements.
Support EU-aligned compliance activities, including GDPR security measures, accountability documentation, and NIS2-aligned operational practices.
Track audit findings, corrective action plans, and management responses; monitor remediation and validate closure evidence.
Maintain and improve audit artifacts, control matrices, evidence inventories, and standardized templates.
Perform special projects and other assigned duties.