IT Enterprise Risk Analyst

We are a Firm where people truly believe in what they do and strive to achieve the highest standards of performance and success. This position is based in the Firm's global operations center in Tampa, FL. General Description: We are seeking an IT Enterprise Risk Analyst to join our team. The IT Risk Analyst helps manage the Firm’s GRC and IT risk programs, focusing on information security for client data, attorney work, and privileged communications. Reporting to the IT Enterprise Risk Management Manager, the role maintains policies, assesses risks and controls, coordinates third-party reviews, drafts responses for client guidelines, prepares evidence for cyber insurance, and supports audits. Responsibilities align with ISO/IEC 27001/27002, NIST CSF, CIS Controls, SOC 2, HIPAA, GLBA, GDPR, and state privacy laws (e.g., CCPA/CPRA). Key Responsibilities and Essential Job Functions: Policy, Standards and Governance Support the development, review, and maintenance of information security and technology risk policies, standards, procedures, and guidance documents. Maintain the policy lifecycle process, including stakeholder reviews, approvals, publication, periodic review schedules, and version control. Map policies/standards to ISO, NIST, CIS Controls, SOC 2, HIPAA, GLBA, U.S. state privacy laws, and EU requirements, and to applicable client Outside Counsel Guidelines and contractual security addenda; maintain crosswalks and control documentation to support audit readiness. Administer policy exception and risk acceptance of workflows, ensuring justification, compensating controls, approvals, and defined expiration/renewal dates. Contribute to awareness materials and operational guidance to promote consistent implementation of requirements. Help maintain controls supporting ethical walls / information barriers, matter-level access restrictions, and legal hold obligations, under the direction of the Senior Analyst and in partnership with the Office of the General Counsel, Conflicts, and Records & Information Governance. Maintain awareness of the Firm’s professional responsibility obligations, including ABA Model Rules 1.1 (technology competence) and 1.6 (confidentiality of information), and apply that awareness to policy implementation and control activities. Information Security and Technology Risk Management Conduct or facilitate risk assessments for applications, infrastructure, cloud services, Firm-critical legal-industry platforms (document management, time and billing, conflicts and new business intake, eDiscovery, and matter management), and key business processes; document risk statements, likelihood/impact, and control effectiveness. Maintain and update the risk register, including inherent and residual ratings, treatment plans, owners, milestones, and status updates. Partner with control owners to identify remediation actions, track progress, and validate closure with appropriate evidence. Support ongoing risk monitoring through key risk