Senior IT Audit, Risk & Security Governance Analyst

Overview

In this role you will support the firm’s information security governance, risk and assurance objectives by conducting risk-based IT audits, security assessments and third-party risk reviews. You will collaborate with Technology, Information Security, Risk and Procurement to align with the security framework and standards. You will manage evidence, remediation tracking and support internal/external audits and due diligence requests. You will help develop and mature the third‑party risk programme and supplier onboarding, strengthening governance across the vendor lifecycle.

Responsibilities

• Plan and execute risk-based IT and information security audits, control assessments and compliance reviews across functions, platforms, and third parties
• Assess control design and operating effectiveness across governance, access management, change management, IT operations, cloud, network and endpoint security, data protection, incident management, resilience and supplier management
• Define scope, objectives, test procedures and sampling with stakeholders
• Produce clear workpapers and reports detailing evidence, gaps, risk, and actionable recommendations
• Maintain findings, remediation records and track actions to closure
• Support audits, client security assessments, regulatory reviews and assurance requests by coordinating evidence
• Respond to RFPs, RFIs and due diligence questionnaires for business development and onboarding
• Perform third-party risk activities across lifecycle including onboarding, monitoring and offboarding
• Improve vendor assessment and onboarding cycle times through scoped evidence requirements and stakeholder coordination
• Coordinate periodic reviews of critical/high-risk vendors and maintain a forward review schedule
• Monitor critical suppliers, investigate alerts and track remediation to closure
• Maintain audit-ready inventories, risk records and remediation status
• Work with multiple stakeholders to identify and manage third-party risk
• Support governance of third-party integrations, APIs and data exchanges, including lifecycle controls and risk remediation

Key requirements

• Strong understanding of information security, technology risk, governance, compliance, audit and control principles
• Experience planning or performing IT or information security audits, risk assessments, control testing or compliance reviews
• Knowledge of audit principles across governance, asset management, IAM, change management, IT operations, cloud and network security, incident management, resilience, supplier management and compliance
• Experience conducting third-party security due diligence and supporting vendor risk management
• Experience improving assessment workflows and meeting service levels
• Knowledge of third-party integration and API risks including data exchange and lifecycle governance
• Familiarity with GRC or external security-rating platforms; SecurityScorecard is advantageous
• Working knowledge of ISO 27001, NIST CSF, NIST SP 800-53, COBIT, SOC 2 or equivalent
• Knowledge of AD, cloud services, networking, endpoint management, SaaS and security monitoring
• Ability to evaluate evidence, identify gaps and propose improvements
• Strong business acumen and stakeholder management with professional English
• Proficiency in Word and Excel and data/reporting tools
• Ability to work independently and manage competing priorities
• Bachelor’s degree in relevant field or substantial equivalent experience
• Certifications such as CISA, CRISC, CISM, CISSP, ISO 27001 Lead Auditor preferred

• Stakeholder management
• Attention to detail
• Analytical thinking
• IT audits and risk assessments
• GRC platforms or third-party risk management
• ISO 27001, NIST CSF, NIST SP 800-53, COBIT, SOC 2 awareness

…