IT Risk and Compliance Analyst

Position Title: IT Risk and Compliance Analyst Location: Washington, DC | New York, NY | Boston, MA | Chicago, IL Position Type: Full time Requisition ID: JR100812 Job Summary The IT Risk and Compliance Analyst is a highly visible, client-facing role that works closely with Legal and Business Unit stakeholders and reports to the IT Risk and Compliance Manager. The analyst evaluates, assesses, and monitors the firm’s risk and compliance with information security standards, frameworks, best practices, and applicable laws and regulations. The role coordinates and maintains the Information Security Management Program and implements security policy objectives aligned with business goals. Key Contacts IT Risk and Compliance Manager – reporting line Legal and Business Unit stakeholders – close collaboration IT Security and Infrastructure Team – coordination on security assessments Clients – respond to security assessment and due diligence questionnaires across various industries Internal and External Auditors – evidence for controls and remediation testing Major Responsibilities Provide IT security, risk, and compliance advice to business units on an ongoing basis. Analyze and address gaps to ensure integrity of processes, controls, and policies. Maintain and update Information Security Program policies and procedures; conduct yearly reviews. Govern participation in the information security incident response process and ensure procedures are followed. Respond to escalated security events and drive the incident response process. Participate in evaluation, development and implementation of security standards, procedures, and guidelines for multiple platforms and systems environments. Work with auditors to demonstrate controls and conduct additional testing when needed. Complete client security questionnaires and assist business units with RFI responses related to IT security. Assist with vendor vetting and risk assessments for new or current vendors, partners, or suppliers. Conduct complex security assessments across IT topics such as Identity and Access Management, Security Architecture, Physical and Environmental, and more. Evaluate, test, document, and maintain firmwide DR and BCP policies, processes, and standards. Coordinate Security Awareness Training initiatives and phishing campaigns with HR. Requirements Associate Degree or equivalent work experience. Minimum 3 years of experience in at least two major IT functions (infrastructure, operations, datacenter, application support, etc.). Minimum 3 years of experience in IT security, IT compliance, or IT risk management. Experience with ISO27001 annual surveillance and full recertification audits. Knowledge of industry frameworks and standards such as SOC2, HIPAA, HITRUST, GDPR, and CCPA. Experience using GRC tools. Knowledge of application and network security, information security risk management, and industry best practices. Experience building, executing, and maintaining DR and BCP programs. Strong prioritization, task execution, written and verbal communication, time management, troubleshooting, problem-solving, and analytical skills. Travel required for short periods, up to 5 working days, with reimbursement for travel expenses. Salary Range: $90,000–$115,000 Candidate must be able to submit verification of legal right to work in the U.S. without company sponsorship. Equal Opportunity Employer BRG is an Equal Employment Opportunity and affirmative action employer. All qualified candidates will receive consideration for employment without regard to race, color, religion, sex, gender identity, sexual orientation, national origin, disability, or protected veteran status. Job ID: 84544370 #J-18808-Ljbffr Koitecc Solutions