IT Enterprise Risk Analyst
Core
Manage the Firm's GRC and IT risk programs, focusing on information security for client data, attorney work, and privileged communications.
Role type
IT Enterprise Risk Analyst
Builds
Policies, risk registers, audit evidence, and vendor risk assessments for a law firm
Domain
Legal industry / Information Security / GRC
Deliverable
production ML models | product features | dashboards & analysis | research | client delivery | infrastructure | physical/clinical work
Required skills
GRC, information security, technology risk management, compliance, internal audit, third-party risk management, ISO/IEC 27000, NIST CSF, HIPAA, GDPR, audit support, risk assessment, vendor due diligence
Preferred skills
Law firm GRC experience, legal-industry technology (iManage, Relativity), ABA Model Rules, CUI handling, cloud security
Technologies
Microsoft 365, iManage, NetDocuments, 3E, Aderant, Intapp, Relativity
Responsibilities
Develop and maintain information security policies and standards; conduct risk assessments for applications and infrastructure; manage third-party security due diligence and vendor risk; support internal and external audits and evidence collection; draft responses to client security questionnaires and guidelines.
Seniority
Mid-level, hands-on IC
