Position SummaryThe Analyst, Cybersecurity & Compliance will assist the Senior Analyst, Cybersecurity & Compliance in protecting the firm against cybersecurity threats. The team is tasked with identifying, evaluating, and monitoring potential cybersecurity risks. They will collaborate with various teams within the firm to ensure that Governance, Risk Management, and Compliance (GRC) areas such as Audits, Information Security Certifications, and Vendor Management Risks are effectively managed. This includes adhering to industry and cybersecurity standards, as well as client and government regulations.
Furthermore, the Analyst, Cybersecurity & Compliance will assist stakeholders in incorporating appropriate security measures into business operations, system designs, and software development processes. This role is responsible for assist in enhancing and implementing processes that assist in planning remediation strategies to ensure compliance with policies and regulations. By providing valuable insights for risk prioritization, the Analyst will prepare reports that highlight trends, risk levels, and metrics. They will focus on building trust and fostering cross-functional partnerships to elevate awareness and successfully implement cybersecurity controls across the firm.
The roles and responsibilities of this job include:
- Assist Sr. Analyst in GRC management principles and practices
- Provide support for internal assessments and audits at planned intervals and on an ad hoc basis to evaluate and validate the design and operational effectiveness of technical and administrative controls to help reduce risk in the organization
- Assist and monitor open audit items from internal and external audits, which can come from compliance, client, or certification requirements. Support and coordinate audit evidence collection to ensure completion of remediation activities defined in the agreed action plans and risk treatment plans
- Produce operational reporting for compliance and risk (control completion, evidence freshness, overdue items, remediation SLAs), and communicate trends to stakeholders
- Assist with identifying and implementing opportunities to automate manual GRC processes using tools such as Microsoft Copilot and Power Platform.
- GRC tooling administration (basic to intermediate): Maintain control libraries, evidence repositories, and task workflows within GRC platforms (e.g., Vanta, Drata, ServiceNow GRC, One Trust, C1Risk), including user access, templates, and assignments
- Risk register maintenance and prioritization, maintain an actionable risk register, ensuring risks have clear statements, likelihood/impact scoring, owners, and remediation plans aligned to business priorities
- Support the Firm's business resiliency program by contributing to business impact analyses, disaster recovery exercises; updating business continuity plans; documenting lessons learned; and assigning and tracking follow-up actions
- Partner with Technology teams to define processes that meet control intent while fitting delivery realities (e.g., CI/CD approvals, IaC reviews, incident response workflows).
- Coordinate with Legal, Privacy, and Procurement on third-party risk by supporting due diligence intake calls, documenting risks, and following up with internal stakeholders, vendors and Legal. Convert risk identified into MSA mitigation clauses for those who handle sensitive data or provide critical services.
- Support the security awareness and training program by developing role-based courses, conducting quarterly phishing simulations, preparing accurate management reports, and contributing to security awareness content and communications.
- Design, manage, and update company's compliance related documentation and reports
- Create any necessary road maps for regulatory compliance
The qualifications for this role:
- 3 + years of experience within GRC, specifically vendor Intake process or risk management standards and frameworks
- Possessing or working towards a cybersecurity certification, CRISC, CISM, CGEIT, CISA, CISSP
- Understanding of industry standards, certifications, and regulations including NIST800 -53, CSF 2.0 and ISO 27001
- Working knowledge with compliance programs related to SSAE16 SOC1, SOC2, PCI
- GRC tooling knowledge (basic to intermediate) of any tool, e.g., Vanta, Drata, ServiceNow GRC, One Trust, C1Risk, etc.
- Reviews Secure SDLC life cycle assessments.
- Working knowledge of enterprise infrastructure and application monitoring tools
- Proficient in Microsoft Office applications; SME in Excel, PowerBI, database, Dashboarding tools and data manipulation
- Attention to detail. Clear logical and analytical thinker
- Able to prioritize and manage multiple tasks under pressure
- Good verbal, written and numeric skills
- Ability to travel or work overtime, as needed
This role reports to Senior Manager, Security and Business Continuity
Benefits at White & CaseWhite & Case LLP offers a comprehensive suite of benefit programs to all eligible employees, including medical, dental, and vision insurance, life and disability coverage, 401(k) retirement savings, vacation time, and leave programs (including parental leave). Exempt roles are also performance bonus eligible.
The Firm may modify and amend any job description at any time in its sole discretion. Nothing herein creates a contract of employment or otherwise modifies the at-will nature of employment.
The above is only a general description of the essential duties associated with this position and does not represent an exhaustive or comprehensive list of all duties.
Note to Recruitment AgenciesOur internal Recruitment team manages all aspects of lateral hiring. All agencies must have signed terms of business-specific to the relevant office-before submitting any candidates. CVs or applications sent directly to White & Case partners or employees will also not be considered formal introductions. If you have questions, please contact the relevant Recruitment team. We work with our preferred suppliers when engaging agencies.
