IT Risk & Compliance Lead: Vendor Security & Controls

Ecmc Group; Minneapolis (MN); Hybrid; USD 90,000 - 100,000; Full time

Benefits offered by this job

Health & wellness benefits

Life & disability insurance

401(k) plan with company match

Paid time off

Commuter subsidy

Tuition reimbursement

Student loan repayment

Job summary

ECMC Group, headquartered in Minneapolis, seeks an IT Compliance professional to plan, execute and report on complex IT compliance activities across information systems. The role partners with procurement and legal, reviews vendor contracts, and drives remediation progress to strengthen controls.

The position requires 3+ years in IT risk and compliance, familiarity with FISMA/NIST/ISO frameworks, and a hybrid work schedule in Minneapolis, MN.

Qualifications

• Bachelor's degree or 2 years of relevant experience in lieu of degree.
• 3+ years in IT risk and compliance, IT governance, IT auditing or related field.
• Experience assessing vendor risk and reviewing contracts.
• Experience with AWS or cloud environments.
• Advanced knowledge of Microsoft Office and Excel; SharePoint familiarity.
• Familiarity with frameworks such as NIST, ISO2700, COSO and COBIT.

Responsibilities

• Leads and performs complex IT compliance activities including planning, risk analysis, testing and reporting.
• Leads vendor security risk assessments and reviews security and compliance provisions within vendor contracts.
• Engages management to assess processes, identify control weaknesses and discuss compliance observations and risks.
• Prepares documentation and draft reports communicating results, risks and recommendations to improve information system controls and practices.
• Plans and executes IT compliance reviews and supports audits through evidence preparation and auditor coordination.
• Contributes to enterprise risk assessments by identifying emerging risks and improvement opportunities.

Skills

IT risk & compliance

Vendor risk assessments

Auditing capabilities

Policy development

Data analytics

Security concepts (FISMA, PCI, HIPAA)

NIST/ISO2700/COBIT knowledge

Education

Bachelor’s degree or 2 years of relevant experience in lieu of degree

Tools

Excel

SharePoint

AWS or cloud environments

Job description

ECMC Group, headquartered in Minneapolis, seeks an IT Compliance professional to plan, execute and report on complex IT compliance activities across information systems. The role partners with procurement and legal, reviews vendor contracts, and drives remediation progress to strengthen controls.

The position requires 3+ years in IT risk and compliance, familiarity with FISMA/NIST/ISO frameworks, and a hybrid work schedule in Minneapolis, MN.