IT Risk and Compliance Analyst

Greenberg Traurig • Austin, TX

1d • Hybrid

About The Position

Greenberg Traurig is seeking an IT Risk and Compliance Analyst to join its Technology Team. The role may be based in various offices on a hybrid basis and reports to the Technology Security Manager.

The analyst will lead the ongoing design, development, and management of the firm’s third-party risk management program. The position involves developing, monitoring, and assessing risks related to vendor and partner relationships, and supporting the firm’s broader information security and business continuity efforts. The ideal candidate can work independently in a fast-paced, deadline-driven environment, communicate effectively with stakeholders at all levels, and handle confidential information appropriately.

Requirements

• Understanding of information security concepts, IT, security awareness, and third-party risk management processes, methodologies, and practices.
• Strong analytical and problem-solving capabilities, including the ability to identify and resolve issues independently using sound judgment.
• Strong interpersonal, written, and verbal communication skills, with the ability to interact effectively throughout the organization, including with C-suite stakeholders.
• Ability to explain technical concepts to non-technical stakeholders and follow basic troubleshooting steps.
• Basic project management and documentation skills, including the ability to manage multiple parallel work streams.
• Ability to multitask and perform effectively under pressure, meeting short lead times and tight deadlines while delivering strong service.
• Ability to work independently on complex technical and business matters and to assume a team leader role as needed.
• Proficiency with the Microsoft Office suite and Windows-based software.
• Ability to recognize and maintain the confidentiality of confidential, sensitive, and proprietary information.
• Availability outside normal working hours for emergency events such as security incidents, breaches, and investigations.
• Bachelor’s degree in information technology, information systems, information security, business administration, or risk management, or equivalent experience; alternatively, at least 3 years of relevant information risk work experience in lieu of a degree.
• 1–3 years of experience implementing and/or supporting IT risk management processes.
• 1–3 years of experience responding to vendor IT risk assessments.
• Experience working with IT audits, findings, and tracking remediation through resolution.
• Working knowledge of cloud technologies such as Azure, AWS, Alibaba, GCP, or IBM Cloud, and software delivery models such as SaaS, PaaS, and IaaS.
• Working knowledge of security exchange platforms, such as ProcessUnity, OneTrust, UpGuard, CyberGRX, Prevalent, Archer, or LogicManager.
• Proficiency with standard information-gathering tools such as DDQ and SIG.

Nice To Haves

• Experience working with compliance issues involving sensitive data.
• Industry certifications such as TPRA, CTPRP, CTPRA, CEH, CISA, or CISM; candidates without relevant certifications are expected to work toward obtaining them during employment.
• Working knowledge of AI and cloud fundamentals, such as AI-900 certification.
• Working knowledge of AI technologies, including generative AI, Copilot, and ChatGPT.

Responsibilities

• Complete vendor risk assessments submitted by clients and prospective clients, including RFPs.
• Respond to client Requests for Proposals and security questionnaires.
• Perform information security due diligence on third-party vendors, assess their controls, identify discrepancies, and recommend actions to management.
• Assess client needs against security concerns and resolve risk issues.
• Develop, implement, assign, and monitor third-party vendor assessments.
• Execute and document assessment activities in accordance with established processes and procedures.
• Review third parties’ information security posture and practices.
• Monitor regulatory and compliance developments relevant to the third-party due diligence program.
• Collaborate with team members as a subject matter expert on the firm’s third-party risk management program and create or update materials for employees, external auditors, and internal auditors.
• Continuously improve and, where possible, automate the third-party risk management program in alignment with industry practices, business objectives, and risk tolerance.
• Lead third-party risk threat notifications by assessing vendor risk, impact, and response, and track vendors’ mitigation progress.
• Develop, implement, and monitor key performance indicators and key risk indicators for the third-party risk management program.
• Develop and update third-party risk management policies, procedures, and best practices.
• Participate in external third-party risk management communities.
• Work with the security team to develop, manage, and maintain the firm’s information security, security awareness, and insider threat programs.
• Identify information security and business continuity risks, inform senior management, and recommend corrective or mitigating actions.
• Assess third-party vendors’ business continuity and disaster recovery compliance and communicate status and impact to the firm’s BCP/DR team.
• Perform other related duties as required and assigned.

Benefits

• Competitive compensation
• Excellent benefits package

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level