Description & Requirements
The IT Audit, Security Governance, Risk & Compliance Analyst will work closely with stakeholders across Technology, Information Security, Risk, Procurement and Business Services teams to support the Firm's information security governance, risk, compliance and assurance objectives.
The role holder will be responsible for delivering risk-based IT audits, security assessments, third-party risk reviews and governance activities, ensuring alignment with the Firm's ISMS, risk framework, policies and applicable standards. They will support the effective management of information security risks, strengthen compliance and assurance processes, and promote consistent governance across the Firm's technology environment, suppliers and integrations.
Main responsibilities:
IT Audit and Assurance:
- Plan and perform risk-based IT and information security audits, control assessments and compliance reviews across technology, business processes and third parties.
- Assess control design and operating effectiveness across access management, change management, IT operations, cloud, network and endpoint security, secure development, incident management, resilience and supplier management.
- Define audit scope, testing and evidence requirements; document clear findings, root causes, risk implications and practical recommendations.
- Track remediation actions to closure, validate corrective action and escalate overdue or material issues.
- Support internal and external audits, client security assessments, regulatory reviews and assurance requests.
Third-Party Risk Management
- Perform security due diligence across the third-party lifecycle, including intake, risk classification, assessment, onboarding, monitoring, periodic review, issue management and offboarding.
- Improve assessment and vendor or client onboarding cycle times through proportionate scoping, clear evidence requirements, stakeholder coordination and timely escalation.
- Coordinate a proactive annual review programme for critical and high-risk vendors, maintaining an accurate forward review schedule and audit-ready records.
- Monitor critical vendors using SecurityScorecard or equivalent services, investigate material alerts and actively follow up remediation to closure.
- Evaluate supplier assurance evidence, including SOC 2 reports, ISO/IEC 27001 certifications, security questionnaires and penetration-test summaries.
API Integration Governance and Audit:
- Partner with the IT and other technology stakeholders ensuring the organization maintains centralized control and oversight of 3rd party integrations.
- Provide independent audit and GRC oversight of third-party APIs, connected applications and data exchanges, ensuring centralised ownership, inventory, approval and lifecycle governance.
- Review integration documentation, architecture and data flows to assess authentication, authorisation, least privilege, encryption, secrets management, logging, monitoring, resilience and privacy controls.
- Identify unmanaged or insufficiently governed integrations and coordinate remediation, restriction, retirement or formal risk acceptance.
- Validate that the API gateway and associated governance processes provide appropriate visibility, traceability, access control and oversight of third-party connectivity.
Governance, Reporting and Improvement:
- Work with Information Security, IT Infrastructure, Architecture, Engineering, Procurement, Legal, Privacy, Compliance, business owners and vendors to embed risk and assurance requirements.
- Maintain complete and accurate inventories, risk records, review dates, findings, exceptions and remediation status.
- Develop KPIs, KRIs and dashboards covering audit delivery, vendor onboarding, review cycle times, critical-vendor monitoring, integration governance and remediation.
- Improve policies, standards, procedures, assessment methods and templates, and identify opportunities to streamline or automate GRC processes without reducing control quality.
Technical Skills and Experience:
- Experience performing IT or information security audits, control assessments, compliance reviews or third-party risk assessments.
- Strong understanding of IT general controls and security domains, including identity and access management, change management, IT operations, cloud, network security, incident management and resilience.
- Experience supporting third-party risk activities across onboarding, periodic review, continuous monitoring, issue management and offboarding.
- Working knowledge of third-party integrations and API risks, including ownership, inventory, authentication, authorisation, data exchange, secrets management, logging, monitoring and lifecycle governance.
- Experience reviewing assurance evidence such as SOC 2 reports, ISO/IEC 27001 certifications, security questionnaires and penetration-test summaries.
- Familiarity with GRC, third-party risk or security-rating platforms; experience with SecurityScorecard or an equivalent service is advantageous.
- Working knowledge of ISO/IEC 27001, NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-161, COBIT, SOC 2 or equivalent frameworks.
- Ability to evaluate evidence, identify control gaps, assess risk and produce concise, defensible findings and recommendations.
Qualifications and Working Style:
- Relevant experience in IT audit, information security assurance, third-party risk management, technology risk or security governance.
- Bachelor’s degree in Computer Science, Information Security, Information Systems, Audit, Risk Management or a related discipline, or substantial equivalent experience.
- Strong analytical, organisational and stakeholder-management skills, with professional written and spoken English.
- Ability to work independently and collaboratively, manage competing priorities and maintain accurate, audit-ready records.
Preferred Certifications:
- CISA, CRISC, CISM, CISSP, ISO 27001 Lead Auditor, CTPRP or an equivalent certification is preferred.
Reports to: Associate Director, Information Security
Position type: Centre Services
Development framework: Supervisor/Specialist
About us
Baker McKenzie empowers clients to compete in the global economy. We provide comprehensive and practical legal advice that cuts through complexity with clear, actionable guidance. Our people represent diverse cultures and jurisdictions, combining local know-how with international expertise to ensure your business thrives across borders.
Additional Information
Baker McKenzie is an Equal Opportunity Employer. We are committed to promoting diversity and inclusion for all. Our unique international culture is reflected in the drawing together of a worldwide family of individuals from diverse cultures and backgrounds in all of our offices. We encourage the best people - regardless of race, religion or belief if any, gender, gender identity, disability, sexual orientation or age - to fulfill their professional aspirations with us. We are committed to ensuring an inclusive and accessible experience for all candidates.
Requisition ID: 3684
Posting Date: 20-Oct-2026
Location Type: Hybrid
Full Time or Part Time: Full Time