Senior Risk & Compliance Analyst

ECMC Group•Minneapolis, MN

1d•$115,000 - $125,000•Hybrid

About The Position

Serves as a senior member of the IT Risk and Compliance function, providing expertise and independent judgment to support the organization's risk management, regulatory compliance, and information security objectives. Partners with stakeholders across the enterprise to evaluate risk, strengthen controls, and promote compliance with applicable standards and requirements. Acts as a trusted advisor within the organization, contributing to the effectiveness and continuous improvement of risk and compliance practices while serving as a resource to less experienced team members.

Requirements

Bachelor's degree in Computer Information Systems, Information Technology, Legal Studies, or a related field; or an additional two years of relevant IT experience in lieu of a degree.
5+ years of experience in IT risk and compliance, IT governance, IT auditing, information security, or a related field.
Experience supporting SOC reporting, third-party assessments, FISMA readiness activities, and internal or external audits.
Experience applying security control frameworks, risk assessment methodologies, and compliance standards, including NIST, ISO 27001, COSO, COBIT, PCI DSS, HIPAA, or similar frameworks.
Experience evaluating or supporting controls related to identity and access management, vulnerability management, data protection, change management, software development lifecycle, or other IT control domains.
Experience assessing security controls within AWS or other cloud environments.
Advanced proficiency with Microsoft Office applications, including Excel data analysis and SharePoint content and site administration.
Experience developing and delivering training, awareness content, or learning programs using Articulate Rise or similar learning platforms.

Nice To Haves

Certified Information Systems Auditor (CISA), Certified Internal Auditor (CIA) certifications
Big 4 accounting firm experience

Responsibilities

Leads and performs medium to high complexity IT risk and compliance reviews, including planning, risk analysis, evidence gathering, control testing, and reporting.
Coordinates and supports FISMA readiness assessments, SOC reporting, external penetration testing, and internal and external audit activities.
Plans and coordinates security awareness initiatives, including annual training, phishing simulations, security communications, and custom learning content.
Leads vendor security risk assessments and evaluates security and compliance requirements within vendor relationships.
Independently engages stakeholders to identify control weaknesses, assess compliance risks, and recommend corrective actions.
Prepares clear documentation, reports, and recommendations that improve information system controls and risk management practices.
Secures stakeholder ownership of findings and remediation plans and monitors progress through resolution.
Completes enterprise risk assessments and supports the design and implementation of effective controls to address emerging risks and compliance requirements.
Contributes to the development and continuous improvement of risk and compliance standards, policies, procedures, monitoring activities, and governance practices.
Mentors less experienced team members, manages stakeholder expectations, and communicates complex compliance concepts to business and technology leaders.
Performs other duties or responsibilities as assigned.

Benefits

Medical, dental, and vision insurance plan options, with a generous employer subsidy.
Company paid life & disability insurance
Pre-tax flexible spending accounts
Robust wellness programs
Generous 401(k) plan with a company match up to 6% and additional discretionary contribution potential
Holiday time off
Paid time off accrual starting at 20 days/year
Commuter subsidy
Tuition reimbursement up to $10,500/year for approved programs
Student loan payment reimbursement up to $4,800/year