IT Audit & Security GRC Analyst

Baker McKenzie; Belfast City District; On-site; GBP 65,000 - 90,000; Full time

Job summary

Baker McKenzie in Belfast seeks an IT Audit, Security Governance, Risk & Compliance Analyst to support governance and assurance objectives across Technology and Information Security. You will deliver risk-based IT audits, third-party risk reviews and API integration governance.

The role requires knowledge of ISMS, controls and frameworks (ISO27001, NIST). You will collaborate with stakeholders, track remediation and prepare audit-ready records.

Qualifications

• Experience performing IT or information security audits, control assessments, compliance reviews or third-party risk assessments.
• Strong understanding of IT general controls and security domains including IAM, change mgmt, IT operations, cloud, network security, incidents and resilience.
• Experience supporting third-party risk activities across onboarding, periodic review, continuous monitoring, issue management and offboarding.
• Knowledge of third-party integrations and API risks including ownership, inventory, authentication, data exchange, secrets management, logging and lifecycle governance.
• Experience reviewing assurance evidence such as SOC 2 reports, ISO 27001 certifications, security questionnaires and penetration-test summaries.
• Familiarity with GRC, third-party risk or security-rating platforms; SecurityScorecard or equivalent is advantageous.
• Working knowledge of ISO/IEC 27001, NIST CSF, NIST SP 800-53, 800-161, COBIT, SOC 2 or equivalent frameworks.
• Ability to evaluate evidence, identify control gaps, assess risk and produce concise, defensible findings and recommendations.

Responsibilities

• Plan and perform risk-based IT and information security audits, control assessments and compliance reviews across technology, business processes and third parties.
• Assess control design and operating effectiveness across access management, change management, IT operations, cloud, network and endpoint security, secure development, incident management, resilience and supplier management.
• Define audit scope, testing and evidence requirements; document clear findings, root causes, risk implications and practical recommendations.
• Track remediation actions to closure, validate corrective action and elevate overdue or material issues.
• Support internal and external audits, client security assessments, regulatory reviews and assurance requests.
• Perform security due diligence across the third-party lifecycle, including intake, risk classification, assessment, onboarding, monitoring, periodic review, issue management and offboarding.
• Coordinate annual review programme for critical and high-risk vendors, maintaining an accurate forward review schedule and audit-ready records.
• Monitor critical vendors using SecurityScorecard or equivalent services, investigate material alerts and follow up remediation to closure.
• Evaluate supplier assurance evidence, including SOC 2, ISO 27001, security questionnaires and penetration-test summaries.
• Review integration documentation, architecture and data flows to assess authentication, authorisation, least privilege, encryption, secrets management, logging, monitoring, resilience and privacy controls.
• Identify unmanaged or insufficiently governed integrations and coordinate remediation, restriction, retirement or formal risk acceptance.
• Validate that the API gateway and governance processes provide visibility, traceability, access control and oversight of third-party connectivity.
• Work with stakeholders to embed risk and assurance requirements and maintain audit-ready records.

Skills

IT audit

Information security

Third-party risk

GRC governance

APIs governance

SOC 2

ISO27001

Risk assessment

Vendor management

Audit reporting

Education

Bachelor's degree

Tools

SecurityScorecard

GRC platforms

Job description

Baker McKenzie in Belfast seeks an IT Audit, Security Governance, Risk & Compliance Analyst to support governance and assurance objectives across Technology and Information Security. You will deliver risk-based IT audits, third-party risk reviews and API integration governance.

The role requires knowledge of ISMS, controls and frameworks (ISO27001, NIST). You will collaborate with stakeholders, track remediation and prepare audit-ready records.