Senior GRC & ISMS Security Analyst

Dorsey & Whitney LLP; Phoenix (AZ); On-site; USD 110,000 - 170,000; Full time

Benefits offered by this job

Medical insurance

Dental & vision coverage

401(k)

Paid time off

Parental leave

Job summary

Dorsey & Whitney LLP is seeking a Senior GRC Information Security Systems Analyst to lead security initiatives across audits, risk, governance, and compliance. Based in Phoenix, this role reports to the Information Security Systems Manager and focuses on ISMS audits, policy maintenance, and client security assessments.

You will drive repeatable IAM RBAC processes, oversee DLP programs to meet ISO and regulatory requirements, and collaborate with stakeholders to deliver cybersecurity consulting

Qualifications

• Bachelor's degree or equivalent in Business, CS, or related field.
• 7+ years of ISMS, risk, audit, governance, and security controls experience.
• Experience with ISO 27001, SOC 2, GDPR, NIST CSF/800-53.
• Hands-on IAM, RBAC design, least privilege, and privileged access management.

Responsibilities

• Maintain ISMS documentation and information security controls.
• Lead risk assessments, audits, and management reviews.
• Support pre- and post-contract security controls and client RFP inputs.
• Oversee NetDocuments access reviews and DLP program compliance.
• Collaborate with stakeholders to automate and monitor security controls.

Skills

GRC framework

ISMS

audits & reviews

RBAC & entitlement

DLP program

vendor risk

communication

security governance

Education

Bachelor's degree in Computer Science or related

Tools

NetDocuments

Azure AD/Entra

Job description

Dorsey & Whitney LLP is seeking a Senior GRC Information Security Systems Analyst to lead security initiatives across audits, risk, governance, and compliance. Based in Phoenix, this role reports to the Information Security Systems Manager and focuses on ISMS audits, policy maintenance, and client security assessments.

You will drive repeatable IAM RBAC processes, oversee DLP programs to meet ISO and regulatory requirements, and collaborate with stakeholders to deliver cybersecurity consulting