IT Audit, Security Governance Risk & Compliance Analyst

Posting Date: 20-Oct-2026

Requisition s/Provinces/Cities:
Belfast, Buenos Aires, Manila Location Type:
Hybrid Business Unit:
Business Professionals Function:
Technology Full Time or Part Time:
Full Time Apply:  IT Audit, Security Governance, Risk & Compliance Analyst will work closely with stakeholders across Technology, Information Security, Risk, Procurement and Business Services teams to support the Firm's information security governance, risk, compliance and assurance objectives.

The role holder will be responsible for delivering risk-based IT audits, security assessments, third-party risk reviews and governance activities, ensuring alignment with the Firm's ISMS, risk framework, policies and applicable standards. They will support the effective management of information security risks, strengthen compliance and assurance processes, and promote consistent governance across the Firm's technology environment, suppliers and integrations.

Main responsibilities:

IT Audit and Assurance:

Plan and perform risk-based IT and information security audits, control assessments and compliance reviews across technology, business processes and third parties.

Assess control design and operating effectiveness across access management, change management, IT operations, cloud, network and endpoint security, secure development, incident management, resilience and supplier management.

Define audit scope, testing and evidence requirements; document clear findings, root causes, risk implications and practical recommendations.

Track remediation actions to closure, validate corrective action and escalate overdue or material issues.

Support internal and external audits, client security assessments, regulatory reviews and assurance requests.

Third-Party Risk Management Perform security due diligence across the third-party lifecycle, including intake, risk classification, assessment, onboarding, monitoring, periodic review, issue management and offboarding.

Improve assessment and vendor or client onboarding cycle times through proportionate scoping, clear evidence requirements, stakeholder coordination and timely escalation.

Coordinate a proactive annual review programme for critical and high-risk vendors, maintaining an accurate forward review schedule and audit-ready records.

Monitor critical vendors using Security Scorecard or equivalent services, investigate material alerts and actively follow up remediation to closure.

Evaluate supplier assurance evidence, including SOC 2 reports, ISO/IEC 27001 certifications, security questionnaires and penetration-test summaries.

API Integration Governance and Audit:

Partner with the IT and other technology stakeholders ensuring the organization maintains centralized control and oversight of 3rd party integrations.

Provide independent audit and GRC oversight of third-party APIs, connected applications and data exchanges, ensuring centralised ownership, inventory, approval and lifecycle governance.

Review integration documentation, architecture and data flows to assess authentication, authorisation, least privilege, encryption, secrets management, logging, monitoring, resilience and privacy controls.

Identify unmanaged or insufficiently governed integrations and coordinate remediation, restriction, retirement or formal risk acceptance.

Validate that the API gateway and associated governance processes provide appropriate visibility, traceability, access control and oversight of third-party connectivity.

Governance, Reporting and Improvement:

Work with Information Security, IT Infrastructure, Architecture, Engineering, Procurement, Legal, Privacy, Compliance, business owners and vendors to embed risk and assurance requirements.

Maintain complete and accurate inventories, risk records, review dates, findings, exceptions and remediation status.

Develop KPIs, KRIs and dashboards covering audit delivery, vendor onboarding, review cycle times, critical-vendor monitoring, integration governance and remediation.

Improve policies, standards, procedures, assessment methods and templates, and identify opportunities to streamline or automate GRC processes without reducing control quality.

Technical

Skills and Experience:

Experience performing IT or information security audits, control assessments, compliance reviews or third-party risk assessments.

Strong understanding of IT general controls and security domains, including identity and access management, change management, IT operations, cloud, network security, incident management and…