Risk & Compliance Analyst II - Third-Party Risk Management

Allegiant•Minneapolis, MN

3d•$102,400 - $124,800

About The Position

The Risk & Compliance Analyst II will lead governance, risk, and compliance initiatives, with a strong focus on third-party risk program management, vendor risk and control assessments, and risk treatment using OneTrust Third-Party Risk Management. The role helps ensure adherence to regulatory requirements, internal policies, and industry standards while continually improving Allegiant’s third-party risk posture. It collaborates with Legal, Information Security, Privacy, IT, Procurement, and business teams to strengthen third-party risk practices and support informed vendor risk decisions. The role also participates in IT governance, risk, and compliance activities, including IT risk assessments, internal controls and policy reviews, risk register maintenance, audit support, risk metrics and reporting, incident management, compliance programs, and business continuity and disaster recovery planning. It coordinates with process owners, management, auditors, vendors, and other stakeholders to document risks, develop remediation plans, and drive actions through completion.

Requirements

Bachelor’s degree in a related field.
At least four years of experience in Internal Audit (IT Audit preferred), IT Risk, or Information Security.
Must be authorized to work in the United States as defined by the Immigration Act of 1986 and pass a criminal background check.
Knowledge of project management skills, including task identification, prioritization, and documentation.
Ability to balance multiple responsibilities that may frequently change, learn information quickly, and apply risk and control considerations to downstream decisions.
Ability to interface effectively with internal and external auditors.
Critical-thinking skills and strong attention to detail and follow-up.
Professionalism, personal integrity, and ability to work independently.
Excellent documentation skills for processes, controls, policies, and risks.
Excellent verbal and written communication skills across all levels, including executive management and the Board of Directors.
Knowledge and experience conducting ongoing risk analysis to identify customer services, supporting processes, systems, components, and applications requiring recovery and determine recovery time frames in line with recovery time objectives.
Familiarity with the internet, LAN and WAN networking, data and voice telecommunications, and cloud computing to assist with recovery procedures.
Knowledge of industry practices and standards such as ISO 27001 and PCI-DSS.
Knowledge of TCP/IP and related protocols.
Familiarity with intrusion detection and prevention techniques.
Ability to research security issues and products as required.
Familiarity with risk management and control frameworks such as COBIT, ISO 27005, COSO, NIST 800-30, and ITIL.
Understanding of internal audit and risk-based methodologies.
Sarbanes-Oxley (SOX) experience and understanding and experience with NIST and PCI standards.
Strong experience in IT Audit, IT Risk, and/or Information Security.
Proficiency in assessing risk and risk management practices.
Knowledge of IT policies, standards, and procedures, and security frameworks and their development and implementation.
Hands-on experience with OneTrust Third-Party Risk Management, including third-party intake, assessment workflows, questionnaires, issues, remediation tracking, reporting, and ongoing monitoring.
Understanding of end-to-end third-party risk management, including intake and scoping, inherent risk assessment, due diligence, control assessment, residual risk determination, risk treatment, ongoing monitoring, reassessment, and offboarding.
Ability to identify and evaluate third-party risks and controls across information security, privacy, access management, vulnerability management, incident management, business continuity and disaster recovery, regulatory compliance, and data protection.
Experience documenting control gaps, risk findings, compensating controls, residual risk, remediation plans, and formal risk acceptance decisions.
Understanding of risk treatment options, including mitigation, remediation, transfer, avoidance, and acceptance, and ability to recommend treatment based on severity and business context.
Ability to lead multiple concurrent third-party assessments and coordinate deliverables with vendors, business owners, Information Security, Privacy, Legal, Procurement, and other stakeholders.
Strong analytical and critical-thinking skills, including ability to review vendor evidence and determine whether controls are appropriately designed and implemented.
Ability to produce concise and defensible risk narratives, assessment conclusions, issue statements, action plans, and executive-level reporting.
Excellent verbal and written communication with technical and nontechnical audiences, including leadership and external vendors.
Ability to work independently, prioritize changing demands, follow up on open issues, and drive risk treatment activities to completion.
Knowledge of relevant frameworks and standards such as NIST, ISO 27001, PCI DSS, SOC 2, COBIT, and applicable privacy requirements.
Experience with IT risk, information security, internal audit, procurement, vendor management, or compliance programs.

Nice To Haves

Preferred industry certifications include CTPRP, CTPRA, CRISC, CISSP, or a comparable credential in risk management, auditing, privacy, or information security. The posting also identifies CISA as a preferred certification.
Familiarity with GRC (Governance, Risk Management, and Compliance) or IRC (Integrated Risk Management) applications.

Responsibilities

Participate in IT governance, risk, and compliance activities.
Perform IT risk assessments, including identifying risks arising from technology and process changes and reviewing supporting processes and procedures to evaluate whether controls are appropriate and risks are mitigated.
Gather business, regulatory, process, and system information; validate or update process flows, risks, and controls; and prepare clear, accurate, complete, and timely analysis and documentation.
Maintain the risk register and support continuous improvement of IT risk management processes.
Consult with management and team members to assess risks associated with technology solutions, identify current and emerging risks and strategic initiatives, and ensure appropriate remediation strategies are employed.
Support IT regulatory examinations and internal audits.
Write controls and action plans for deficiencies.
Assist in developing IT Risk & Compliance metrics and reporting frameworks and deliver reports weekly, monthly, and quarterly.
Manage testing request lists from internal and external auditors and serve as an interface between IT management and auditors.
Define action plans and timelines with process owners and manage them through completion and implementation.
Assist with information security incident management, including investigating, documenting, and reporting incidents affecting confidentiality, integrity, or availability.
Support administration of IT policies, standards, and procedures; ensure they meet applicable guidelines and are housed, refreshed, inventoried, and approved.
Draft information security deliverables for internal and external partners on topics including security breaches and policy governance.
Conduct scheduled assessments to identify gaps in IT business continuity, emergency, and disaster recovery plans.
Maintain and update plans and practices for communication and restoration of operations during IT emergencies.
Coordinate scheduling of disaster recovery and failover tests with the IT disaster recovery team to ensure critical applications are tested against recovery standards.
Participate in IT business continuity awareness training; identify potential interruptions, develop safeguards, and implement recovery procedures. Provide documentation and training on contingency planning concepts and procedures.
Support assessments of the operational effectiveness of security controls and any required remediation.
Assist in executing information security programs, including meeting NIST and PCI-DSS compliance requirements.
Assist in developing and updating compliance standards.
Perform other duties as necessary.