IT Audit, Security Governance Risk & Compliance Analyst

Overview

In this role you will support the firm’s information security governance, risk, and compliance objectives through risk-based IT audits, security assessments, and third-party risk reviews. You will collaborate with Technology, Information Security, Risk, Procurement and Business Services to strengthen controls and assurance across our technology landscape and supplier ecosystem. You will drive remediation tracking, assurance activities, and governance improvements to sustain compliant and secure operations at scale. This position offers a meaningful opportunity to shape risk management practices in a global professional services environment.

Responsibilities

• Plan and execute risk-based IT and information security audits across technology, business processes and third parties
• Assess control design and effectiveness in areas like access, change, IT operations, cloud, network, secure development and incident response
• Define scope, evidence needs, findings, and recommendations; monitor remediation and escalate overdue issues
• Support internal/ external audits, client security assessments, regulatory reviews and assurance requests
• Conduct third-party security due diligence across onboarding, ongoing monitoring, and offboarding
• Improve vendor onboarding and review cycles with clear evidence requirements and stakeholder coordination
• Coordinate annual reviews for critical/high-risk vendors and maintain audit-ready records
• Monitor critical vendors using SecurityScorecard or equivalent and drive remediation
• Evaluate supplier assurance evidence including SOC 2, ISO/IEC 27001, security questionnaires and pen-test summaries
• Provide independent audit and GRC oversight of API integrations, ensuring centralized governance and lifecycle management
• Review integration docs, architecture and data flows for authentication, least privilege, encryption, logging, and privacy controls
• Identify unmanaged integrations and coordinate remediation or risk acceptance
• Develop KPIs, KRIs and dashboards for audit delivery, vendor onboarding, and remediation status
• Continually improve policies, standards, templates and opportunities to streamline GRC processes

Key requirements

• Experience performing IT or information security audits, control assessments and third-party risk activities
• Strong understanding of IT general controls and security domains (IAM, change mgmt, IT operations, cloud, network, incident management, resilience)
• Familiarity with third-party risk processes (onboarding, monitoring, issue management, offboarding)
• Knowledge of API risks, integrations, data exchange, authentication, authorization and secrets management
• Experience reviewing assurance evidence (SOC 2, ISO/IEC 27001, security questionnaires, pen-test summaries)
• Familiarity with GRC/third-party risk platforms; SecurityScorecard is advantageous
• Knowledge of ISO/IEC 27001, NIST CSF, NIST SP 800-53/161, COBIT, SOC 2 or equivalent
• Ability to assess evidence, identify control gaps, and produce concise findings
• Bachelor’s degree in a related discipline or substantial equivalent experience
• Strong analytical, organizational and stakeholder-management skills; English proficient

• analytical thinking
• stakeholder management
• independent and collaborative work
• IT general controls
• identity and access management
• change management

…