IT Risk and Compliance Analyst

Greenberg Traurig•Atlanta, GA

2d•Hybrid

About The Position

The IT Risk and Compliance Analyst leads the ongoing design, development, and management of the firm’s third-party risk management program. The role develops, monitors, and assesses risks related to vendor and partner relationships, evaluates vendor information security controls, and makes recommendations to management. The analyst also supports the firm’s Information Security Program and related security awareness, insider threat, and business continuity efforts. This position can be based in various offices on a hybrid basis and reports to the Technology Security Manager. Work is highly independent on complex technical and business matters, with the possibility of assuming a team leader role as needed. The employee must be available outside normal working hours for emergency events such as security incidents, breaches, and investigations.

Requirements

Bachelor’s degree in information technology, Information Systems, Information Security, Business Administration, or Risk Management, or equivalent experience; alternatively, 3 or more years of relevant information risk work experience in lieu of a degree.
1–3 years of experience implementing and/or supporting IT risk management processes.
1–3 years of experience responding to vendor IT risk assessments.
Experience working with IT audits, findings, and tracking remediation through resolution.
Understanding of information security concepts, IT, information security awareness, and third-party risk management processes, methodologies, and practices.
Strong analytical and problem-solving capabilities, sound judgment, and ability to resolve issues independently and effectively.
Strong interpersonal, written, and verbal communication skills, including the ability to interact across organizational levels from analyst to C-suite.
Ability to explain technical concepts to non-technical stakeholders and follow basic troubleshooting steps.
Basic project management and documentation skills, including the ability to manage multiple parallel work streams.
Ability to multitask and work effectively under pressure, meeting short lead times and tight deadlines while providing strong service to clients and stakeholders.
Ability to work independently on complex technical and business matters and assume a team leader role as needed.
Proficiency with Microsoft Office and Windows-based software.
Ability to recognize confidential, sensitive, and proprietary information and maintain its confidentiality.
Availability outside normal working hours for emergency events, including security incidents, breaches, and investigations.
Working knowledge of cloud technologies such as Azure, AWS, Alibaba, GCP, or IBM Cloud, and software delivery models such as SaaS, PaaS, and IaaS.
Working knowledge of security exchanges or platforms such as ProcessUnity, OneTrust, UpGuard, CyberGRX, Prevalent, Archer, or LogicManager.
Proficiency with standard information-gathering tools such as DDQ and SIG.
Working knowledge of AI and cloud fundamentals and AI technologies, including Gen AI, Copilot, and ChatGPT.

Nice To Haves

Experience working with compliance issues involving sensitive data.
Industry certifications such as TPRA, CTPRP, CTPRA, CEH, CISA, or CISM; candidates without relevant certifications are expected to work toward obtaining them during employment.
Working knowledge of AI and cloud fundamentals, such as AI-900 certification.

Responsibilities

Complete vendor risk assessments submitted by clients and prospective clients, including RFPs.
Respond to client Requests for Proposals and security questionnaires.
Perform information security due diligence on third-party vendors, evaluate the effectiveness of controls protecting firm data, identify discrepancies, and recommend actions to management.
Assess client needs against security concerns and resolve risk issues.
Develop, implement, assign, and monitor third-party vendor assessments.
Execute and document assessment activities following established processes and procedures.
Review third parties to assess vendor information security posture and practices.
Monitor regulatory and compliance developments relevant to the third-party due diligence program.
Collaborate with team members as a subject matter expert on the third-party risk management program, and create or update materials for employees and auditors.
Continuously improve the third-party risk management program, including automation where possible, in alignment with expert knowledge, industry practices, business objectives, and risk tolerance.
Lead third-party risk threat notifications by assessing vendor risk, impact, and response; track vendor mitigation progress for identified threats and risks.
Develop, implement, and monitor KPIs and KRIs for the third-party risk management program.
Develop and update third-party risk management policies, procedures, and best practices.
Participate in external Third-Party Risk Management communities.
Work with the security team to develop, manage, and maintain the firm’s Information Security Program and security awareness and insider threat programs.
Identify information security and business continuity risks for senior management and recommend corrective actions or mitigations.
Assess third-party vendor BCP/DR compliance and communicate status and impact to the firm’s BCP/DR team.
Perform other related duties as required and assigned.