Senior IT Risk & Compliance Lead (Hybrid)

ECMC Group; Minneapolis (MN); Hybrid; USD 115,000 - 125,000; Full time

Benefits offered by this job

Health & wellness benefits

401(k) plan with company match

Tuition reimbursement

Job summary

ECMC Group, a nonprofit headquartered in Minneapolis, seeks a senior IT risk and compliance leader to support risk management, regulatory compliance, and information security objectives. You will partner with stakeholders to evaluate risk, strengthen controls, and promote compliance with applicable standards.

You will oversee risk reviews, FISMA readiness, SOC reporting, audits, and security awareness initiatives, while mentoring junior staff and driving governance improvements across the

Qualifications

• Bachelor's degree in Computer Information Systems, Information Technology, Legal Studies, or related field, or +2 years relevant IT experience in lieu of a degree.
• 5+ years of IT risk and compliance, IT governance, IT auditing, information security, or related field.
• Experience supporting SOC reporting, third-party assessments, FISMA readiness activities, and audits.
• Experience applying security control frameworks (NIST, ISO 27001, COSO, COBIT, PCI DSS, HIPAA).
• Experience evaluating controls in IAM, vulnerability management, data protection, change management, SDLC, or other IT control domains.
• Experience assessing security controls in AWS or other cloud environments.
• Proficiency with Microsoft Office, especially Excel and SharePoint.
• Experience delivering training/learning content (Articulate Rise).

Responsibilities

• Leads medium to high complexity IT risk and compliance reviews (planning, risk analysis, testing, reporting).
• Supports FISMA readiness, SOC reporting, external penetration testing, and audits.
• Coordinates security awareness initiatives and phishing simulations.
• Leads vendor security risk assessments within vendor relationships.
• Engages stakeholders to identify control weaknesses and remediation actions.
• Documents findings and ensures ownership and progress on remediation.
• Performs enterprise risk assessments and helps design effective controls.
• Contributes to development and improvement of risk and compliance standards and governance.

Skills

IT risk

Compliance

SOC reporting

FISMA

NIST

ISO 27001

COSO

COBIT

PCI DSS

HIPAA

Education

Bachelor's degree or higher in CIS/IT/Legal Studies

Tools

Excel

SharePoint

Articulate Rise

Job description

ECMC Group, a nonprofit headquartered in Minneapolis, seeks a senior IT risk and compliance leader to support risk management, regulatory compliance, and information security objectives. You will partner with stakeholders to evaluate risk, strengthen controls, and promote compliance with applicable standards.

You will oversee risk reviews, FISMA readiness, SOC reporting, audits, and security awareness initiatives, while mentoring junior staff and driving governance improvements across the