Senior IT Risk & Compliance Strategist

Ecmc Group; Minneapolis (MN); Hybrid; USD 115,000 - 125,000; Full time

Benefits offered by this job

Health & wellness benefits: medical, d

Life & disability insurance

401(k) with company match

Tuition reimbursement

Job summary

ECMC Group in Minneapolis seeks a senior IT Risk and Compliance leader to guide risk management, regulatory compliance, and information security programs. You will partner with stakeholders to drive assessments, control testing, and training across the enterprise.

You will mentor team members, coordinate audits, and promote strong governance practices while advancing risk-based controls. Hybrid work in Minneapolis with growth opportunities within a mission-driven nonprofit.

Qualifications

• Bachelor's degree in Computer Information Systems, Information Technology, Legal Studies, or a related field; or an additional two years of relevant IT experience in lieu of a degree.
• 5+ years of experience in IT risk and compliance, IT governance, IT auditing, information security, or a related field.
• Experience supporting SOC reporting, third-party assessments, FISMA readiness activities, and internal or external audits.
• Experience applying security control frameworks, risk assessment methodologies, and compliance standards, including NIST, ISO 27001, COSO, COBIT, PCI DSS, HIPAA, or similar frameworks.
• Experience evaluating or supporting controls related to identity and access management, vulnerability management, data protection, change management, software development lifecycle, or other IT control domains.
• Experience assessing security controls within AWS or other cloud environments.
• Advanced proficiency with Microsoft Office applications, including Excel data analysis and SharePoint content and site administration.

Responsibilities

• Leads medium to high complexity IT risk and compliance reviews, including planning, risk analysis, evidence gathering, control testing, and reporting.
• Coordinates and supports FISMA readiness assessments, SOC reporting, external penetration testing, and audits.
• Plans and coordinates security awareness initiatives, including annual training and phishing simulations.
• Leads vendor security risk assessments and evaluates security and compliance requirements within vendor relationships.
• Prepares documentation, reports, and remediation plans to improve information system controls and risk management.

Skills

IT risk & compliance expertise

SOC reporting experience

Security frameworks (NIST, ISO 27001,)

IAM controls

Cloud security (AWS)

Audit coordination

Training content development

Education

Bachelor's degree in CIS/IT or related field

Tools

Excel

SharePoint

Job description

ECMC Group in Minneapolis seeks a senior IT Risk and Compliance leader to guide risk management, regulatory compliance, and information security programs. You will partner with stakeholders to drive assessments, control testing, and training across the enterprise.

You will mentor team members, coordinate audits, and promote strong governance practices while advancing risk-based controls. Hybrid work in Minneapolis with growth opportunities within a mission-driven nonprofit.