IT Enterprise Risk Analyst

Holland & Knight; Miami (FL); On-site; USD 80,000 - 140,000; Full time

Job summary

Holland & Knight in Tampa, FL is seeking an IT Enterprise Risk Analyst to join our team. The role focuses on managing the Firm’s GRC and IT risk programs, with emphasis on information security for client data, attorney work, and privileged communications.

Responsibilities include developing and maintaining information security policies and standards, conducting risk assessments across applications, infrastructure, cloud services and core processes, managing the risk register, coordinating

Qualifications

• Experience implementing information security programs and governance.
• Ability to perform risk assessments across applications, infrastructure and cloud services.
• Familiarity with regulatory frameworks (ISO/NIST/CIS/SOC 2/HIPAA/GDPR).
• Experience coordinating third-party risk reviews and audits.

Responsibilities

• Policy, standards and governance support for information security and technology risk.
• Maintain policy lifecycle, map controls to ISO/NIST/CIS/SOC 2 and regulatory requirements.
• Conduct risk assessments for firm systems and core processes and maintain risk register.
• Coordinate third-party security due diligence and evidence collection for audits.

Skills

Information security

GRC

Risk assessment

Vendor risk management

Job description

We are a Firm where people truly believe in what they do and strive to achieve the highest standards of performance and success. This position is based in the Firm's global operations center in Tampa, FL.

General Description:

General Description: We are seeking an IT Enterprise Risk Analyst to join our team. The IT Risk Analyst helps manage the Firm’s GRC and IT risk programs, focusing on information security for client data, attorney work, and privileged communications. Reporting to the IT Enterprise Risk Management Manager, the role maintains policies, assesses risks and controls, coordinates third-party reviews, drafts responses for client guidelines, prepares evidence for cyber insurance, and supports audits. Responsibilities align with ISO/IEC 27001/27002, NIST CSF, CIS Controls, SOC 2, HIPAA, GLBA, GDPR, and state privacy laws (e.g., CCPA/CPRA).

Key Responsibilities and Essential Job Functions:

Key Responsibilities and Essential Job Functions: Policy, Standards and Governance Support the development, review, and maintenance of information security and technology risk policies, standards, procedures, and guidance documents. Maintain the policy lifecycle process, including stakeholder reviews, approvals, publication, periodic review schedules, and version control. Map policies/standards to ISO, NIST, CIS Controls, SOC 2, HIPAA, GLBA, U.S. state privacy laws, and EU requirements, and to applicable client Outside Counsel Guidelines and contractual security addenda; maintain crosswalks and control documentation to support audit readiness. Administer policy exception and risk acceptance of workflows, ensuring justification, compensating controls, approvals, and defined expiration/renewal dates. Contribute to awareness materials and operational guidance to promote consistent implementation of requirements. Help maintain controls supporting ethical walls / information barriers, matter-level access restrictions, and legal hold obligations, under the direction of the Senior Analyst and in partnership with the Office of the General Counsel, Conflicts, and Records & Information Governance. Maintain awareness of the Firm’s professional responsibility obligations, including ABA Model Rules 1.1 (technology competence) and 1.6 (confidentiality of information), and apply that awareness to policy implementation and control activities.

Information Security and Technology Risk Management

Information Security and Technology Risk Management Conduct or facilitate risk assessments for applications, infrastructure, cloud services, Firm-critical legal-industry platforms (document management, time and billing, conflicts and new business intake, eDiscovery, and matter management), and key business processes; document risk statements, likelihood/impact, and control effectiveness. Maintain and update the risk register, including inherent and residual ratings, treatment plans, owners, milestones, and status updates. Partner with control owners to identify remediation actions, track progress, and validate closure with appropriate evidence. Support ongoing risk monitoring through key risk indicators (KRIs) and control health metrics, including indicators relevant to the legal sector (e.g., business email compromise and wire-fraud schemes, ransomware targeting law firms, and client-confidential data exposure). Draft and contribute to risk reporting and summaries for governance forums under the direction of the IT Enterprise Risk Management Manager, including content packaged for Firm leadership and Firm Management Committee audiences. Support incident response activities by gathering control and risk evidence, contributing to post-incident lessons learned, and helping ensure resulting control improvements are tracked in the risk register.

Vendor/Third Party Risk Management (TPRM)

Vendor/Third Party Risk Management (TPRM) Perform third party security due diligence based on vendor criticality and risk tiering (including third-industry parties such as co-counsel and local counsel, eDiscovery and document review providers, expert witnesses, court reporters and translators, legal-technology SaaS vendors, and managed-service providers handling client matter data); coordinate security questionnaires and evidence collection. Review assurance artifacts such as SOC reports, ISO certificates, penetration test summaries, security whitepapers, and privacy/security attestations. Identify gaps, document findings, recommend remediation/compensating controls, and track vendor action plans to closure. Partner with Procurement/Legal to ensure contracts include appropriate security and privacy requirements (e.g., breach notification, subcontractor controls, right-to-assess, data processing terms, and data residency as applicable). Support periodic vendor reassessments and reassessments triggered by scope changes, incidents, or material updates. Draft initial responses to inbound client security questionnaires and Outside Counsel Guideline (OCG) inquiries for Senior Analyst review; help maintain a controlled answer library and partner with the engagement attorney and Loss Prevention on follow-ups.

Audit, Assurance and Compliance (ISO / NIST / CIS / SOC 2 / HIPAA / GLBA / EU)

Audit, Assurance and Compliance (ISO / NIST / CIS / SOC 2 / HIPAA / GLBA / EU) Support internal and external audits by coordinating evidence collection, control walkthroughs, and timely responses to audit requests. Assist with gap assessments and control testing against ISO 27001/27002, NIST CSF / SP 800-53 / 800-171, CIS Controls, SOC 2 Trust Services Criteria, GLBA Safeguards Rule, and HIPAA requirements. Support EU-aligned compliance activities where applicable (e.g., GDPR security measures and accountability documentation; NIS2-aligned operational practices). Track audit findings, corrective action plans (CAPs), and management responses; monitor remediation progress and validate closure evidence. Maintain audit artifacts including control matrices, evidence inventories, and standardized templates to improve repeatability and audit readiness. Support control activities related to handling Controlled Unclassified Information (CUI) and other regulated client data for the Firm’s federal, defense, aerospa