Analyst, Cybersecurity and Compliance

Team Summary

Technology Services team is integral to maintaining the Firms overall technology mobile and desktop devices and core infrastructure to ensure reliable secure and efficient operations. Technology Services is a single global operation with representation in each of the Firms offices. Additionally we have shared service centers in Tampa and Manila supporting a wide range of technologies and addition to overseeing critical enterprise systems and providing world-class client service to our global user community we are committed to achieving a balance between new and innovative technologies while constantly ensuring data security and compliance with legal and regulatory standards resulting in realizing value from the latest developments in technology such as generative artificial intelligence and cloud computing models while safeguarding sensitive client information against cyber threats and other business interruption events. Technology Services plays a significant role in supporting the Firms systems and people.

Position Summary

The Analyst Cybersecurity & Compliance will assist the Senior Analyst Cybersecurity & Compliance in protecting the firm against cybersecurity threats. The team is tasked with identifying evaluating and monitoring potential cybersecurity risks. They will collaborate with various teams within the firm to ensure that Governance Risk Management and Compliance (GRC) areas such as Audits Information Security Certifications and Vendor Management Risks are effectively managed. This includes adhering to industry and cybersecurity standards as well as client and government regulations.

Furthermore the Analyst Cybersecurity & Compliance will assist stakeholders in incorporating appropriate security measures into business operations system designs and software development processes. This role is responsible for assist in enhancing and implementing processes that assist in planning remediation strategies to ensure compliance with policies and regulations. By providing valuable insights for risk prioritization the Analyst will prepare reports that highlight trends risk levels and metrics. They will focus on building trust and fostering cross-functional partnerships to elevate awareness and successfully implement cybersecurity controls across the firm.

The roles and responsibilities of this job include:

• Assist Sr. Analyst in GRC management principles and practices
• Provide support for internal assessments and audits at planned intervals and on an ad hoc basis to evaluate and validate the design and operational effectiveness of technical and administrative controls to help reduce risk in the organization
• Assist and monitor open audit items from internal and external audits which can come from compliance client or certification requirements. Support and coordinate audit evidence collection to ensure completion of remediation activities defined in the agreed action plans and risk treatment plans
• Produce operational reporting for compliance and risk (control completion evidence freshness overdue items remediation SLAs) and communicate trends to stakeholders
• Assist with identifying and implementing opportunities to automate manual GRC processes using tools such as Microsoft Copilot and Power Platform.
• GRC tooling administration (basic to intermediate): Maintain control libraries evidence repositories and task workflows within GRC platforms (e.g. Vanta Drata ServiceNow GRC One Trust C1Risk) including user access templates and assignments
• Risk register maintenance and prioritization maintain an actionable risk register ensuring risks have clear statements likelihood/impact scoring owners and remediation plans aligned to business priorities
• Support the Firms business resiliency program by contributing to business impact analyses disaster recovery exercises; updating business continuity plans; documenting lessons learned; and assigning and tracking follow-up actions
• Partner with Technology teams to define processes that meet control intent while fitting delivery realities (e.g. CI/CD approvals IaC reviews incident response workflows).
• Coordinate with Legal Privacy and Procurement on third-party risk by supporting due diligence intake calls documenting risks and following up with internal stakeholders vendors and Legal. Convert risk identified into MSA mitigation clauses for those who handle sensitive data or provide critical services.
• Support the security awareness and training program by developing role-based courses conducting quarterly phishing simulations preparing accurate management reports and contributing to security awareness content and communications.
• Design manage and update companys compliance related documentation and reports
• Create any necessary road maps for regulatory compliance

The qualifications for this role:

• 3 years of experience within GRC specifically vendor Intake process or risk management standards and frameworks
• Possessing or working towards a cybersecurity certification CRISC CISM CGEIT CISA CISSP
• Understanding of industry standards certifications and regulations including NIST800 -53 CSF 2.0 and ISO 27001
• Working knowledge with compliance programs related to SSAE16 SOC1 SOC2 PCI
• GRC tooling knowledge (basic to intermediate) of any tool e.g. Vanta Drata ServiceNow GRC One Trust C1Risk etc.
• Reviews Secure SDLC life cycle assessments.
• Working knowledge of enterprise infrastructure and application monitoring tools
• Proficient in Microsoft Office applications; SME in Excel PowerBI database Dashboarding tools and data manipulation
• Attention to detail. Clear logical and analytical thinker
• Able to prioritize and manage multiple tasks under pressure
• Good verbal written and numeric skills
• Ability to travel or work overtime as needed

This role reports to

Senior Manager Security and Business Continuity

Equal Opportunities

White & Case is an Equal Employment Opportunity (EEO) employer and is committed to creating a fair workplace. It is our Firms policy to recruit employ train compensate and promote without regard to race color religion creed national origin age gender sexual orientation marital status military or veteran status disability genetic information or any other category protected by applicable law.

Applicants who are interested in applying for a position and require an accommodation during the process should contact

Benefits at White & Case

White & Case LLP offers a comprehensive suite of benefit programs to all eligible employees including medical dental and vision insurance life and disability coverage 401(k) retirement savings vacation time and leave programs (including parental leave). Exempt roles are also performance bonus eligible.

The Firm may modify and amend any job description at any time in its sole discretion. Nothing herein creates a contract of employment or otherwise modifies the at-will nature of employment.

The above is only a general description of the essential duties associated with this position and does not represent an exhaustive or comprehensive list of all duties.

Note to Recruitment Agencies

Our internal Recruitment team manages all aspects of lateral hiring. All agencies must have signed terms of businessspecific to the relevant officebefore submitting any candidates. CVs or applications sent directly to White & Case partners or employees will also not be considered formal introductions. If you have questions please contact the relevant Recruitment team. We work with our preferred suppliers when engaging agencies.

Required Experience:

IC