Risk & Compliance Analyst II - Third-Party Risk Management

Allegiant•Minneapolis, MN

About The Position

The Risk & Compliance Analyst II – Third-Party Risk Management (TPRM) leads governance, risk, and compliance initiatives, with a focus on third-party risk program management, vendor risk and control assessments, and risk treatment using OneTrust Third-Party Risk Management. The role supports compliance with regulatory requirements, internal policies, and industry standards while improving Allegiant’s third-party risk posture. It collaborates with Legal, Information Security, Privacy, IT, Procurement, business teams, vendors, auditors, and management to support informed vendor risk decisions and effective risk treatment. The position also contributes to IT governance, risk, and compliance activities, including IT risk assessments and consulting, audit and regulatory examination support, risk metrics and reporting, policy administration, incident support, security control assessments, and business continuity and disaster recovery planning. The role prepares risk and control documentation, coordinates remediation activities, and supports compliance programs and standards.

Requirements

Bachelor’s degree in a related field.
At least four years of experience in Internal Audit (IT Audit preferred), IT Risk, or Information Security.
Must be authorized to work in the United States as defined by the Immigration Act of 1986 and pass a criminal background check.
Knowledge of project management skills, including task identification, prioritization, and documentation.
Ability to balance changing responsibilities, learn information quickly, and apply risk and control considerations to downstream decisions.
Ability to interface effectively with internal and external auditors.
Critical thinking, strong attention to detail, and follow-up skills; professionalism, personal integrity, and ability to work independently.
Excellent documentation skills for processes, controls, policies, and risks.
Excellent verbal and written communication skills across all personnel levels, including executive management and the Board of Directors, as well as technical and nontechnical audiences and external vendors.
Knowledge and experience performing ongoing risk analysis to determine which customer services, business processes, systems, components, and applications need recovery and within what time frame to meet recovery time objectives.
Familiarity with internet, LAN and WAN networking, data and voice telecommunications, and cloud computing to assist in preparing recovery procedures.
Knowledge of industry practices and standards such as ISO 27001 and PCI-DSS, and good knowledge of TCP/IP and related protocols.
Familiarity with intrusion detection and prevention techniques and ability to research security issues and products.
Familiarity with risk management and control frameworks such as COBIT, ISO 27005, COSO, NIST 800-30, and ITIL.
Understanding of internal audit and risk-based methodologies, Sarbanes-Oxley (SOX), NIST, and PCI standards.
Strong experience in IT Audit, IT Risk, and/or Information Security; proficiency in assessing risk and risk management practices.
Knowledge of IT policies, standards, procedures, security frameworks, and their development and implementation.
Hands-on experience with OneTrust Third-Party Risk Management, including third-party intake, assessment workflows, questionnaires, issues, remediation tracking, reporting, and ongoing monitoring.
Solid understanding of end-to-end third-party risk management processes, including intake and scoping, inherent risk assessment, due diligence, control assessment, residual risk determination, risk treatment, ongoing monitoring, reassessment, and offboarding.
Ability to identify and evaluate third-party risks and controls, review vendor evidence, and determine whether controls are appropriately designed and implemented.
Understanding of risk treatment options, including mitigation, remediation, transfer, avoidance, and acceptance, and ability to recommend treatment based on risk severity and business context.
Ability to lead multiple concurrent third-party assessments, prioritize changing demands, follow up on open issues, and drive risk treatment to completion.
Ability to produce concise, defensible risk narratives, assessment conclusions, issue statements, action plans, and executive-level reporting.

Nice To Haves

Preferred industry certification such as CTPRP, CTPRA, CRISC, CISSP, CISA, or a comparable credential in risk management, auditing, privacy, or information security.
Familiarity with GRC (Governance, Risk Management, and Compliance) or IRC (Integrated Risk Management) applications.
Experience with IT risk, information security, internal audit, procurement, vendor management, or compliance programs.
Knowledge of relevant frameworks and standards including NIST, ISO 27001, PCI DSS, SOC 2, COBIT, and applicable privacy requirements.

Responsibilities

Lead and support third-party risk governance, assessments, and risk treatment using OneTrust Third-Party Risk Management.
Coordinate third-party assessments and deliverables with vendors, business owners, Information Security, Privacy, Legal, Procurement, and other stakeholders.
Assess vendor risks and controls across information security, privacy, access management, vulnerability and incident management, business continuity and disaster recovery, regulatory compliance, and data protection.
Document control gaps, risk findings, compensating controls, residual risk, remediation plans, and formal risk acceptance decisions.
Participate in IT governance, risk, and compliance activities and perform IT risk assessments, including evaluating technological and process changes and the adequacy of related controls.
Gather business, regulatory, process, and system information; validate process flows, risks, and controls; and prepare timely, accurate risk analysis and documentation.
Maintain the risk register and support continuous improvement of IT risk management processes.
Consult with management and team members to assess technology risks and identify appropriate remediation strategies for current, emerging, and strategic risks.
Support IT audits and regulatory examinations, write controls and action plans for deficiencies, and manage auditor testing request lists as an interface between IT management and auditors.
Develop and deliver IT risk metrics and reports on weekly, monthly, and quarterly schedules.
Define action plans and timelines with process owners and manage them through completion and implementation.
Assist with information security incident management by investigating, documenting, and reporting incidents affecting confidentiality, integrity, or availability.
Support administration of IT policies, standards, and procedures, including housing, refreshing, inventorying, and obtaining approval for them.
Draft information security deliverables for internal and external partners on topics including security breaches and policy governance.
Conduct scheduled assessments to identify gaps in IT business continuity, emergency, and disaster recovery plans; maintain and update plans and practices.
Coordinate the IT disaster recovery team in scheduling disaster recovery and failover tests for critical applications.
Participate in business continuity awareness training, identify potential interruptions, develop safeguards, and implement recovery procedures; provide contingency planning documentation and training.
Support assessments of the operational effectiveness of security controls and any required remediation.
Assist with information security programs and NIST and PCI-DSS compliance requirements, and help develop and update compliance standards.
Perform other duties as necessary.