Senior GRC & ISMS Security Analyst

Dorsey & Whitney LLP; Salt Lake City (UT); On-site; USD 120,000 - 180,000; Full time

Job summary

Dorsey & Whitney LLP is seeking a Senior GRC Information Security Systems Analyst to drive audits, risk governance, and compliance initiatives across ISO 27001, GDPR, and related frameworks. You will lead internal ISMS audits, manage policy alignment, and oversee client pre-contract security reviews, with a focus on resilient controls and secure data handling.

You will collaborate with Information Services and business teams, implement RBAC improvements, oversee DLP controls, and support

Qualifications

• Bachelor's degree or equivalent in Business, Computer Science or related field.
• 7+ years of information security experience across ISMS, risk, governance, and audits.
• Experience with ISO 27001, SOC 2, GDPR, NIST CSF or NIST 800-53.
• Hands-on IAM with automation, RBAC design and enforcement.
• DLP program experience and cross-functional collaboration.

Responsibilities

• Support ISMS audits and internal management reviews.
• Maintain policies and controls aligned to ISO 27001 and frameworks.
• Oversee client pre-contract security assessments and risk reviews.
• Collaborate with stakeholders to implement automated controls and RBAC enhancements.
• Review DLP program effectiveness and regulatory mapping.
• Coordinate quarterly NetDocuments access reviews and remediation steps.
• Prepare risk assessments and document findings for leadership.

Skills

Information Security

Audits

Governance

RBAC design

DLP program

IAM automation

Education

Bachelor's Degree or equivalent in Business, Computer Science or equivalent experience

Tools

Azure AD Entra

Microsoft 365

NDMax AI chatbot

Job description

Dorsey & Whitney LLP is seeking a Senior GRC Information Security Systems Analyst to drive audits, risk governance, and compliance initiatives across ISO 27001, GDPR, and related frameworks. You will lead internal ISMS audits, manage policy alignment, and oversee client pre-contract security reviews, with a focus on resilient controls and secure data handling.

You will collaborate with Information Services and business teams, implement RBAC improvements, oversee DLP controls, and support