Analyst, Governance and Risk

Technology Services team is integral to maintaining the Firm’s overall technology, mobile and desktop devices, and core infrastructure to ensure reliable, secure and efficient operations. Technology Services is a single global operation with representation in each of the Firm’s offices. Additionally, we have shared service centers in Tampa and Manila, supporting a wide range of technologies and operations. In addition to overseeing critical enterprise systems and providing world-class client service to our global user community, we are committed to achieving a balance between new and innovative technologies while constantly ensuring data security and compliance with legal and regulatory standards, resulting in realizing value from the latest developments in technology, such as generative artificial intelligence and cloud computing models, while safeguarding sensitive client information against cyber threats and other business interruption events. Technology Services plays a significant role in supporting the Firm’s systems and people.

Position Summary

The Analyst, Governance and Risk plays a pivotal role in protecting the firm against cybersecurity threats. This position is tasked with identifying, evaluating, and monitoring potential cybersecurity risks. They will collaborate with various teams within the firm to ensure that Governance, Risk Management, and Compliance (GRC) areas such as Audits, Information Security Certifications, and Vendor Management Risks are effectively managed. This includes adhering to industry and cybersecurity standards, as well as client and government regulations.

Furthermore, the Analyst, Governance and Risk will guide stakeholders in incorporating appropriate security measures into business operations, system designs, and software development processes. This role is responsible for enhancing and implementing processes that assist in planning remediation strategies to ensure compliance with policies and regulations. By providing valuable insights for risk prioritization, the Analyst will prepare reports that highlight trends, risk levels, and metrics. They will focus on building trust and fostering cross-functional partnerships to elevate awareness and successfully implement cybersecurity controls across the firm.

Duties and Accountabilities1

• Maintain and improve the GRC function
• Provide support for internal assessments and audits at planned intervals and on an ad hoc basis to evaluate and validate the design and operational effectiveness of technical, and administrative controls to help reduce risk in the organization
• Mentor junior GRC Analysts on the team
• Assist with monitoring open audit items from internal audits and external compliance/client/certification audits to ensure completion of remediation activities defined in the agreed action plans and risk treatment plans
• Support continuous monitoring processes to assess compliance with information security policies and standards, legal and regulatory compliance
• Provide compliance subject matter expertise support to various departments
• Assist with conducting third-party vendor information security assessment and ongoing third-party assurance activities
• Design, manage, and update company’s compliance related documentation and reports
• Create any necessary road maps for regulatory compliance

Qualifications

• 5-7+ years of experience within GRC, specifically vendor & risk management standards and frameworks
• Possessing any cybersecurity certifications, CRISC, CISM, CGEIT, CISA,CISSP, etc. 
• Possessing an understanding of industry standards, certifications, and regulations including NIST800/CSF, ISO 27001, 
• Experience with compliance programs related to SSAE16 SOC1, SOC2, PCI, and/or NIST-800-53
• Working knowledge in Cloud Security assessments, systems, tools, and web application reviews including Secure SDLC life cycle assessments. 
• Working knowledge of enterprise infrastructure and application monitoring tools.
• Proficient in Microsoft Office applications; SME in Excel and data manipulation 
• Attention to detail. Clear logical and analytical thinker. 
• Able to prioritize and manage multiple tasks under pressure
• Good verbal, written and numeric skills
• Ability to travel or work overtime, as needed

This role reports to

Senior Manager, Security and Business Continuity

Equal Opportunities

White & Case is committed to creating a fair workplace. It is our Firm’s policy to recruit, employ, train, compensate, and promote without regard to race, religion, creed, national origin, age, gender, sexual orientation, marital status, military or veteran status, disability, genetic information, or any other category protected by applicable law.
 
If you require assistance and/or adjustment to participate in our application and/or interview process, please email us. We will be happy to work with you.

The Firm may modify and amend any job description at any time in its sole discretion. Nothing herein creates a contract of employment or otherwise modifies the at-will nature of employment.

The above is only a general description of the essential duties associated with this position and does not represent an exhaustive or comprehensive list of all duties.

Note to Recruitment Agencies

Our internal Recruitment team manages all aspects of lateral hiring. All agencies must have signed terms of business—specific to the relevant office—before submitting any candidates. CVs or applications sent directly to White & Case partners or employees will also not be considered formal introductions. If you have questions, please contact the relevant Recruitment team. We work with our preferred suppliers when engaging agencies.