Information Security Third-Party Risk Analyst

The Challenge

We are looking for a dynamic Information Security GRC Analyst to support IT and InfoSec by performing various governance, risk, and compliance activities as part of the OneTrust InfoSec GRC team.

Your Mission

To collaborate with our sales team to address customer audits and questionnaires, assist with RFPs/RFQs, and complete third-party risk assessments.

• Supports ongoing third-party risk process and over all risk management
• Works with InfoSec and business owners to standardize responses to customer questionnaires
• Updates or defines policy, standard, and process documentation to align with compliance requirements
• Responds to customer inquiries and RFP/RFQs to provide appropriate answers
• Supports customer audits as needed

You Are

A team player who can work well within the GRC team.

• Collaborate with IT, InfoSec, and within the GRC team to mature the risk management process
• Follow our ongoing risk and control self-assessment, audit management, security risk assessment, and third-party assessment processes
• Provide front line support to the sales organization to ensure that OneTrust’s customers understand the security program and controls and how it meets the requirements of the customer
• Facilitate and manage multiple questionnaires and due diligence activities simultaneously
• Become a trusted advisor to Sales, InfoSec, and the Legal departments
• A Relationship builder: Ability to listen, build rapport, and credibility as a partner vertically and horizontally
• An Innovator: Possess the ability to seek alternatives and recommend best solutions that gain all parties support and lead to win-win results
• Value Driven: You are detail oriented with an eye for quality
• Ability to execute given high level direction
• Asks good questions and always learning

Your Experience Includes

• Understanding of applicable laws and regulations, including but not limited to, GDPR, CCPA, PCI-DSS, SOC 2, ISO, and FedRAMP
• Working knowledge of security risk management, methodologies and procedures
• Understanding of the contract lifecycle
• Understanding of the different types of sensitive data, and the classifications of that data
• Deep understanding information security frameworks, risks and mitigation strategies
• Understanding of technology domains including governance, risk management, security, privacy, and information technology and business continuity
• Planning, supporting, and or executing audits (customer-driven, internal, external)
• Bachelor’s degree; or 3 years of equivalent work experience