Senior GRC & InfoSec Systems Specialist

Dorsey & Whitney LLP; Washington (District of Columbia); On-site; USD 130,000 - 195,000; Full time

Benefits offered by this job

Medical insurance

401(k) plan

Parental leave

Job summary

Dorsey & Whitney LLP is seeking a Senior GRC Information Security Systems Analyst to safeguard the firm by driving audits, governance, and compliance initiatives. You will lead client and pre-contract security assessments, maintain ISMS documentation, and oversee authorization services and quarterly NetDocuments reviews.

The role partners with stakeholders to implement automated controls, RBAC enhancements, and data loss prevention measures, ensuring client and regulatory requirements are met.

Qualifications

• Bachelor's degree or equivalent in Business, CS or related field.
• 7+ years across ISMS, governance, risk, audits, and compliance.
• Experience with ISO 27001, GDPR, SOC2, NIST CSF or NIST 800-53.
• Strong client security assessment, RFP responses, and contract review background.

Responsibilities

• Maintain ISMS documentation and policies aligned to frameworks.
• Lead internal audits, management reviews, and recertification efforts.
• Prepare security input for client RFPs and responses.
• Oversee pre/post-contract security controls and risk reviews.
• Drive RBAC/entitlement improvements and vendor risk assessments.
• Monitor DLP controls and ensure regulatory alignment.

Skills

Security governance

Risk assessment

Audit management

Communication

Project management

Education

Bachelor's Degree or equivalent

Tools

AD Entra

RBAC automation

NetDocuments access reviews

DLP tooling

Job description

Dorsey & Whitney LLP is seeking a Senior GRC Information Security Systems Analyst to safeguard the firm by driving audits, governance, and compliance initiatives. You will lead client and pre-contract security assessments, maintain ISMS documentation, and oversee authorization services and quarterly NetDocuments reviews.

The role partners with stakeholders to implement automated controls, RBAC enhancements, and data loss prevention measures, ensuring client and regulatory requirements are met.