IT Audit, Security Governance Risk & Compliance Analyst

Baker McKenzie; Belfast City District; On-site; GBP 65,000 - 90,000; Full time

Job summary

Baker McKenzie in Belfast seeks an IT Audit, Security Governance, Risk & Compliance Analyst to support governance and assurance objectives across Technology and Information Security. You will deliver risk-based IT audits, third-party risk reviews and API integration governance.

The role requires knowledge of ISMS, controls and frameworks (ISO27001, NIST). You will collaborate with stakeholders, track remediation and prepare audit-ready records.

Qualifications

• Experience performing IT or information security audits, control assessments, compliance reviews or third-party risk assessments.
• Strong understanding of IT general controls and security domains including IAM, change mgmt, IT operations, cloud, network security, incidents and resilience.
• Experience supporting third-party risk activities across onboarding, periodic review, continuous monitoring, issue management and offboarding.
• Knowledge of third-party integrations and API risks including ownership, inventory, authentication, data exchange, secrets management, logging and lifecycle governance.
• Experience reviewing assurance evidence such as SOC 2 reports, ISO 27001 certifications, security questionnaires and penetration-test summaries.
• Familiarity with GRC, third-party risk or security-rating platforms; SecurityScorecard or equivalent is advantageous.
• Working knowledge of ISO/IEC 27001, NIST CSF, NIST SP 800-53, 800-161, COBIT, SOC 2 or equivalent frameworks.
• Ability to evaluate evidence, identify control gaps, assess risk and produce concise, defensible findings and recommendations.

Responsibilities

• Plan and perform risk-based IT and information security audits, control assessments and compliance reviews across technology, business processes and third parties.
• Assess control design and operating effectiveness across access management, change management, IT operations, cloud, network and endpoint security, secure development, incident management, resilience and supplier management.
• Define audit scope, testing and evidence requirements; document clear findings, root causes, risk implications and practical recommendations.
• Track remediation actions to closure, validate corrective action and elevate overdue or material issues.
• Support internal and external audits, client security assessments, regulatory reviews and assurance requests.
• Perform security due diligence across the third-party lifecycle, including intake, risk classification, assessment, onboarding, monitoring, periodic review, issue management and offboarding.
• Coordinate annual review programme for critical and high-risk vendors, maintaining an accurate forward review schedule and audit-ready records.
• Monitor critical vendors using SecurityScorecard or equivalent services, investigate material alerts and follow up remediation to closure.
• Evaluate supplier assurance evidence, including SOC 2, ISO 27001, security questionnaires and penetration-test summaries.
• Review integration documentation, architecture and data flows to assess authentication, authorisation, least privilege, encryption, secrets management, logging, monitoring, resilience and privacy controls.
• Identify unmanaged or insufficiently governed integrations and coordinate remediation, restriction, retirement or formal risk acceptance.
• Validate that the API gateway and governance processes provide visibility, traceability, access control and oversight of third-party connectivity.
• Work with stakeholders to embed risk and assurance requirements and maintain audit-ready records.

Skills

IT audit

Information security

Third-party risk

GRC governance

APIs governance

SOC 2

ISO27001

Risk assessment

Vendor management

Audit reporting

Education

Bachelor's degree

Tools

SecurityScorecard

GRC platforms

Job description

The IT Audit, Security Governance, Risk & Compliance Analyst will work closely with stakeholders across Technology, Information Security, Risk, Procurement and Business Services teams to support the Firm's information security governance, risk, compliance and assurance objectives.

The role holder will be responsible for delivering risk-based IT audits, security assessments, third-party risk reviews and governance activities, ensuring alignment with the Firm's ISMS, risk framework, policies and applicable standards. They will support the effective management of information security risks, strengthen compliance and assurance processes, and promote consistent governance across the Firm's technology environment, suppliers and integrations.

Main responsibilities:

IT Audit and Assurance:

• Plan and perform risk-based IT and information security audits, control assessments and compliance reviews across technology, business processes and third parties.
• Assess control design and operating effectiveness across access management, change management, IT operations, cloud, network and endpoint security, secure development, incident management, resilience and supplier management.
• Define audit scope, testing and evidence requirements; document clear findings, root causes, risk implications and practical recommendations.
• Track remediation actions to closure, validate corrective action and elevate overdue or material issues.
• Support internal and external audits, client security assessments, regulatory reviews and assurance requests.

Third-Party Risk Management

• Perform security due diligence across the third-party lifecycle, including intake, risk classification, assessment, onboarding, monitoring, periodic review, issue management and offboarding.
• Improve assessment and vendor or client onboarding cycle times through proportionate scoping, clear evidence requirements, stakeholder coordination and timely escalation.
• Coordinate a proactive annual review programme for critical and high-risk vendors, maintaining an accurate forward review schedule and audit-ready records.
• Monitor critical vendors using SecurityScorecard or equivalent services, investigate material alerts and actively follow up remediation to closure.
• Evaluate supplier assurance evidence, including SOC 2 reports, ISO/IEC 27001 certifications, security questionnaires and penetration-test summaries.

API Integration Governance and Audit:

• Partner with the IT and other technology stakeholders ensuring the organization maintains centralized control and oversight of 3rd party integrations.
• Provide independent audit and GRC oversight of third-party APIs, connected applications and data exchanges, ensuring centralised ownership, inventory, approval and lifecycle governance.
• Review integration documentation, architecture and data flows to assess authentication, authorisation, least privilege, encryption, secrets management, logging, monitoring, resilience and privacy controls.
• Identify unmanaged or insufficiently governed integrations and coordinate remediation, restriction, retirement or formal risk acceptance.
• Validate that the API gateway and associated governance processes provide appropriate visibility, traceability, access control and oversight of third-party connectivity.

Governance, Reporting and Improvement:

• Work with Information Security, IT Infrastructure, Architecture, Engineering, Procurement, Legal, Privacy, Compliance, business owners and vendors to embed risk and assurance requirements.
• Maintain complete and accurate inventories, risk records, review dates, findings, exceptions and remediation status.
• Develop KPIs, KRIs and dashboards covering audit delivery, vendor onboarding, review cycle times, critical-vendor monitoring, integration governance and remediation.
• Improve policies, standards, procedures, assessment methods and templates, and identify opportunities to streamline or automate GRC processes without reducing control quality.

Technical Skills and Experience:

• Experience performing IT or information security audits, control assessments, compliance reviews or third-party risk assessments.
• Strong understanding of IT general controls and security domains, including identity and access management, change management, IT operations, cloud, network security, incident management and resilience.
• Experience supporting third-party risk activities across onboarding, periodic review, continuous monitoring, issue management and offboarding.
• Working knowledge of third-party integrations and API risks, including ownership, inventory, authentication, authorisation, data exchange, secrets management, logging, monitoring and lifecycle governance.
• Experience reviewing assurance evidence such as SOC 2 reports, ISO/IEC 27001 certifications, security questionnaires and penetration-test summaries.
• Familiarity with GRC, third-party risk or security-rating platforms; experience with SecurityScorecard or an equivalent service is advantageous.
• Working knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-161, COBIT, SOC 2 or equivalent frameworks.
• Ability to evaluate evidence, identify control gaps, assess risk and produce concise, defensible findings and recommendations.

Qualifications and Working Style:

• Relevant experience in IT audit, information security assurance, third-party risk management, technology risk or security governance.
• Bachelor's degree in Computer Science, Information Security, Information Systems, Audit, Risk Management or a related discipline, or substantial equivalent experience.
• Strong analytical, organisational and stakeholder-management skills, with professional written and spoken English.
• Ability to work independently and collaboratively, manage competing priorities and maintain accurate, audit-ready records.

Preferred Certifications:

• CISA, CRISC, CISM, CISSP, ISO 27001 Lead Auditor, CTPRP or an equivalent certification is preferred.

Reports to: Associate Director, Information Security