IT Enterprise Risk Senior Analyst

We are a Firm where people truly believe in what they do and strive to achieve the highest standards of performance and success.

This position may be based in either the firm’s global operations center in the Tampa Bay area or our Dallas office.

General Description: The IT Risk Senior Analyst helps manage the Firm’s GRC and IT risk by identifying and handling security risks across systems, processes, cloud, and third parties, emphasizing protection of confidential information. This role works with attorneys, Risk Management, General Counsel, and technology teams to maintain policies, conduct risk assessments, coordinate third-party security reviews, address client OCGs and audits, support assurance initiatives and cyber insurance, and deliver risk reports for leadership.

Activities align with standards and regulations such as ISO/IEC 27001/27002, NIST CSF and SP 800-171, CIS Controls, SOC 2, HIPAA, GLBA, GDPR, and state privacy laws like CCPA/CPRA.

Key Responsibilities and Essential Job Functions:

• Policy, Standards and Governance Lead the development, review, and maintenance of information security and technology risk policies, standards, procedures, and guidance documents.
• Own the policy lifecycle process, including stakeholder reviews, approvals, publication, periodic review schedules, and version control.
• Map policies and standards to ISO, NIST, CIS Controls, SOC 2, HIPAA, GLBA, U.S. state privacy laws, and EU requirements, and to applicable client Outside Counsel Guidelines and contractual security addenda, and maintain crosswalks and control documentation to support audit readiness and control maturity.
• Administer policy exception and risk acceptance workflows, ensuring sound justification, compensating controls, appropriate approvals, and defined expiration or renewal dates.
• Provide guidance, awareness materials, and operational direction to promote consistent implementation of policy and control requirements across the organization.
• Partner with the Office of the General Counsel, Conflicts, and Records & Information Governance to design and maintain controls supporting ethical walls / information barriers, matter-level access restrictions, and legal hold obligations.
• Ensure information security policy and standards remain consistent with the Firm’s professional responsibility obligations, including ABA Model Rules 1.1 (technology competence) and 1.6 (confidentiality of information) and applicable state bar requirements.
• Information Security and Technology Risk Management Lead complex risk assessments for applications, infrastructure, cloud services, and Firm-critical legal-industry platforms (document management, time and billing, conflicts and new business intake, eDiscovery, and matter management) and key business processes, and document risk statements, likelihood, impact, and control effectiveness, advancing the program toward quantitative risk methods (e.g., FAIR) where appropriate.
• Maintain and enhance the risk register, including inherent and residual ratings, treatment plans, owners, milestones, and status reporting.
• Partner with control owners and business stakeholders to define remediation actions, challenge timelines where needed, track progress, and validate closure with appropriate evidence.
• Support ongoing risk monitoring through key risk indicators, control health metrics, trend analysis, and identification of emerging risks relevant to the legal sector (e.g., business email compromise and wire-fraud schemes, ransomware targeting law firms, insider misuse, and client-confidential data exposure).
• Prepare risk and control reporting suitable for the CISO, CIO, Firm Management Committee, Risk Management Partner, and (where applicable) Audit Committee audiences, translating technical findings into business and client-impact language.
• Provide risk and control-failure analysis in support of incident response activities, contribute to post-incident lessons learned, and ensure resulting control improvements are tracked through the risk register.
• Contribute to the design and maturation of the Firm’s GRC operating model, processes, and tooling, partnering with the IT Enterprise Risk Management Manager and CIO on program strategy and roadmap.
• Vendor / Third‑Party Risk Management (TPRM) Lead third-party security due diligence based on vendor criticality and risk tiering (including legal-industry third parties such as co-counsel and local counsel, eDiscovery and document review providers, expert witnesses, court reporters and translators, legal-technology SaaS vendors, and managed-service providers handling client matter data) , and coordinate security questionnaires, evidence collection, and stakeholder reviews.
• Manage the Firm-as-vendor response process: complete client security questionnaires and Outside Counsel Guideline (OCG) attestations, coordinate evidence packages and SOC 2 / ISO 27001 reliance materials, and support client-led on-site or virtual security audits of the Firm.
• Review assurance artifacts such as SOC reports, ISO certificates, penetration test summaries, security whitepapers, and privacy/security attestations.
• Identify gaps, document findings, recommend remediation or compensating controls, and track vendor action plans to closure.
• Partner with Procurement, Legal, and business owners to ensure contracts include appropriate security and privacy requirements, such as breach notification, subcontractor controls, right-to-assess, data processing terms, and data residency obligations as applicable.
• Lead periodic vendor reassessments and reviews triggered by scope changes, incidents, control concerns, or material service updates.
• Audit, Assurance & Client Security Reviews (ISO / NIST / CIS / SOC 2 / HIPAA / GLBA / EU) Lead coordination for internal and external audits and client-led security reviews by organizing evidence collection, control walkthroughs, stakeholder responses, and timely closure of audit requests.
• Own the inbound client security questionnaire and OCG-response pipeline: triage incoming requests, draft accurate and consistent responses, maintain a controlled answer library, and partner with the engagement attorney and Loss Prevention on client commitments and exceptions.
• Support the annual cyber insurance application and renewal cycle by preparing control attestations, evidence packages, and responses to underwriter and broker inquiries.
• Perform and lead gap assessments and control testing against ISO 27001/27002, NIST CSF, SP 800-53, SP 800-171, CIS Controls, SOC 2 Trust Services Criteria, GLBA Safeguards Rule, and HIPAA requirements.
• Lead the risk and control program for handling Controlled Unclassified Information (CUI) and other regulated client data across the Firm’s federal, defense, aerospace, and government-contracts practices, including alignment with NIST SP 800-171, CMMC Level 2 readiness, ITAR/EAR export-controlled data handling, and FedRAMP-aligned cloud usage; partner with engagement attorneys, the Office of the General Counsel, and IT Infrastructure to ensure matter-specific data-handling, segregation, and personnel-screening requirements are documented, implemented, and evidenced.
• Support EU-aligned compliance activities where applicable, including GDPR security measures, accountability documentation, and NIS2-aligned operational practices.
• Track audit findings, corrective action plans, and management responses, monitor remediation progress, and validate closure evidence.
• Maintain and improve audit artifacts, control matrices, evidence inventories, and standardized templates to enhance repeatability, efficiency, and audit readiness.
• Expected to maintain a regular and predictable work schedule and full attention to and engagement in work activities on behalf of the firm during business hours unless otherwise approved or required by applicable law.
• Special projects and duties as assigned.
• Required Skills: Demonstrated experience collecting, organizing, and validating control evidence and leading audit or assessment support activities.
• Strong written and verbal communication skills, with the ability to translate control requirements into clear documentation, actionable guidance, and leadership-ready reporting.
• Strong organizational skills and attention to detail, with the ability to manage multiple priorities independently, exercise sound judgment, and influence stakeholders across business and technology teams.
• Knowledge or ability to learn Microsoft Office Suite, or Microsoft 365.
• Required Qualifications & Education: Bachelor’s degree in information security, Information Technology, Risk Management, Business, or equivalent practical experience.
• 5+ years of experience in GRC, information security, technology risk management, compliance, internal audit, or third-party risk management.
• Working knowledge of ISO/IEC 27000 Family concepts, NIST CSF/SP 800-53/800-171, and HIPAA.
• Familiarity with EU information security and privacy requirements (e.g., GDPR security principles); familiarity with NIS2 is a plus where relevant.
• Prior experience supporting GRC, IT risk, or information security functions in a law firm, professional services firm, or other client-confidential environment is strongly preferred.
• Familiarity with legal-industry technology (document management such as iManage or NetDocuments; time and billing such as 3E or Aderant; conflicts and new business intake such as Intapp; eDiscovery platforms such as Relativity) and with the data-sensitivity considerations they raise.
• Awareness of the ABA Model Rules of Professional Conduct (in particular Rules 1.1 and 1.6) and applicable state bar requirements relating to technology competence and client confidentiality.
• Hands-on experience with one or more GRC platforms (e.g., Archer, ServiceNow GRC, AuditBoard, OneTrust) and questionnaire-automation tooling (e.g., ProcessUnity, Whistic).
• Demonstrated ability to operate with autonomy in a maturing program, contribute to GRC operating-model design, and mentor junior analysts as the team scales under the future CISO.

Preferred Qualifications & Education:

• Working knowledge of Controlled Unclassified Information (CUI) handling requirements, NIST SP 800-171, CMMC Level 2, ITAR/EAR export-control data restrictions, and FedRAMP-aligned cloud usage; prior support of federal, defense, or government-contracts client matters strongly preferred.
• Physical Requirements: Ability to sit or stand for extended periods of time.
• Moderate or advanced keyboard usage.
• Benefits: Our goal is to promote a work environment in which individuals have access to the resources they need to be their best both professionally and personally, which includes resources that encourage individuals to focus on their health and well-being.
• Below are the benefits we offer: comprehensive medical (PPO and HDHPs), dental and vision plans including coverage for domestic partners; life and AD&D insurance; short and long term disability insurance; tax-advantaged accounts for health care expenses, including FSAs and HSAs; FSAs for dependent care; health advocacy services; behavioral health and counseling resources for all family members; 401(k); profit sharing; backup dependent care; senior care planning support; resources for individuals with development disabilities and their caregivers; and paid holidays and other paid time off, including paid leave for new parents.
• Holland & Knight is an Equal Opportunity Employer and does not discriminate on the basis of race, color, religion, sex (including pregnancy, childbirth or related conditions, transgender status, and sexual orientation), national origin, age, disability, genetic information, veteran status or any other factor prohibited by law.
• Applicants who are interested in applying for a position and require an accommodation during the process should contact ApplicantAccommodations@hklaw.com .
• Personal Information collected from applicants will be used for the purpose of processing the application throughout any recruitment or employment process, as well as inclusion in a personnel file. Categories of data collected may include name, address, phone numbers, email, Social Security Number, and signature. Holland & Knight may collect further information if you consent to a background check. This includes criminal background, employment, and certifications. Please visit Legal Information Portal for Holland & Knight LLP’s privacy policies.