IT Risk & Compliance Analyst
Location: Seattle, Wa or Boise, Id (1 day per week on-site)
Employment: Full-Time
Pay Range: $80K - $95K
We are seeking an experienced IT Risk and Compliance Analyst to join our Bank's team. In this role, you will support the organization’s IT risk management and compliance programs. This includes identifying, assessing, and mitigating risks to the IT environment and ensuring compliance with relevant regulations, standards, and policies. The role also involves collaborating with various stakeholders to implement and maintain a robust IT governance framework.
Along with the key functions listed below, this position will be expected to uphold the value our Bank places on simply being nice when servicing our colleagues and clients.
Role and Responsibilities
Risk Management:
- Develop, support, and maintain an IT risk management framework, including policies, procedures, and control mechanisms, to identify, assess, mitigate, and monitor IT risks across the organization.
- Conduct regular risk assessments, gap analyses, and control testing to evaluate the effectiveness of IT controls and identify potential threats to the IT environment and areas for improvement.
- Collaborate with IT, business units, and other stakeholders to implement risk mitigation strategies and remediation plans for identified control deficiencies.
- Provide support with third-party risk management activities and administration, including compliance documentation collection, contract reviews, contract negotiation, and technology cost analysis.
- Monitor and report on the effectiveness of risk management activities
- Design, build, and maintain key risk indicators and key performance indicators to help measure the department’s effectiveness in managing technology risk and service delivery.
Compliance:
- Ensure IT processes adhere to and maintain compliance with relevant laws, regulations, and industry standards (e.g., FFIEC, GLBA, SOX, etc.), data privacy regulations (e.g., CCPA), and cybersecurity frameworks (e.g., NIST).
- Stay current with changes in relevant laws, regulations, and industry best practices and ensure the organization remains compliant.
- Perform regular compliance audits and assessments.
- Help manage the IT audit process, including coordinating with internal and external auditors, providing necessary documentation, and helping IT control owners address audit findings.
- Facilitate the reviews of IT Audit Management Responses with the IT Leadership team.
- Develop and maintain IT compliance documentation, including policies, procedures, and guidelines.
Governance:
- Assist in the development and maintenance of the IT governance framework.
- Monitor adherence to IT governance policies and procedures and report non-compliance.
- Develop and deliver training programs to educate employees on IT risk management and compliance practices.
Incident Management:
- Assist in the investigation of IT security incidents and breaches.
- Coordinate with the IT and Information Security teams to implement corrective actions and preventive measures.
- Conduct Post Incident Reviews and follow up on remediation activities and reporting.
Internal Controls:
- Evaluate and enhance internal controls over IT systems and processes.
- Work with internal and external auditors during audits and reviews.
- Ensure that IT controls are effectively designed and operating as intended.
Reporting and Documentation:
- Prepare and present risk and compliance reports to senior management and relevant committees, providing insights and recommendations for continuous improvement.
- Maintain detailed records of risk assessments, compliance audits, and incident investigations.
- Provide documentation and support for external audits and regulatory inquiries.
Requirements:
- Strong understanding of IT systems, controls, security practices, relevant laws, regulations, and industry standards.
- Excellent analytical and problem-solving skills, with the ability to identify, assess, and mitigate risks effectively.
- Strong communication and interpersonal skills, with the ability to collaborate with various stakeholders and present complex information clearly.
- Proven project management and organizational skills, with the ability to manage multiple priorities and meet deadlines.
- Proficiency in risk management tools and technologies (e.g., GRC software, data analytics tools).
Qualifications and Education Requirements
- Relevant professional certifications (e.g., Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP)) are preferred.
- Minimum of 3-5 years of experience in IT risk management, IT compliance, or a related field, preferably in the financial services industry.
- Strong understanding of IT risk management frameworks.
- Knowledge of regulatory requirements and industry standards relevant to IT risk and compliance.
- Excellent communication and interpersonal skills, with the ability to effectively interact with stakeholders at all levels of the organization.