Qualification

Excellent documentation skillsAbility to work independentlyExperience with IT riskIndustry certification such as CTPRPSarbanes-Oxley (SOX)Possesses knowledge of IT policiesFamiliarity with either GRC (GovernanceExperience documenting control gapsUnderstanding of risk treatment options

Required

Excellent documentation skills, including concise and defensible risk narratives, assessment conclusions, issue statements, action plans, and executive-level reporting.
Excellent verbal and written communication skills across technical and nontechnical audiences, including leadership and external vendors.
Ability to work independently, prioritize changing demands, follow up on open issues, and drive risk treatment activities to completion.
Knowledge of relevant frameworks and standards such as NIST, ISO 27001, PCI DSS, SOC 2, COBIT, and applicable privacy requirements.
Experience with IT risk, information security, internal audit, procurement, vendor management, or compliance programs.
Industry certification such as CTPRP, CTPRA, CRISC, CISA, CISSP, or a comparable risk/security credential is preferred.
Sarbanes-Oxley (SOX), PCI-DSS experience.
Understanding and experience with NIST and PCI-DSS.
Strong experience in any of the following areas: IT Audit, IT Risk and/or Information Security.
Demonstrate proficiency in assessing risk and risk management practices.
Possesses knowledge of IT policies, standards and procedures, security frameworks and their development and implementation.
Participate in all areas of IT Governance, Risk and Compliance.

Preferred

Preferred Industry certifications include CTPRP, CTPRA, CRISC, CISSP, or a comparable credential in risk management, auditing, privacy, or information security.
Familiarity with either GRC (Governance, risk management, and compliance) or IRC (Integrated Risk Management) applications.
Required hands-on experience with OneTrust Third-Party Risk Management, including third-party intake, assessment workflows, questionnaires, issues, remediation tracking, reporting, and ongoing monitoring.
Solid understanding of end-to-end third-party risk management processes, including intake and scoping, inherent risk assessment, due diligence, control assessment, residual risk determination, risk treatment, ongoing monitoring, reassessment, and offboarding.
Demonstrated ability to identify and evaluate third-party risks and controls across information security, privacy, access management, vulnerability management, incident management, business continuity/disaster recovery, regulatory compliance, and data protection.
Experience documenting control gaps, risk findings, compensating controls, residual risk, remediation plans, and formal risk acceptance decisions.
Understanding of risk treatment options, including mitigation, remediation, transfer, avoidance, and acceptance, and the ability to recommend treatment based on risk severity and business context.

Risk & Compliance Analyst II - Third-Party Risk Management at Allegiantair · LumiJobs

Risk & Compliance Analyst II - Third-Party Risk Management

Responsibilities

Qualification

Required

Preferred

Company

Allegiantair

More roles at Allegiantair