Analyst, Cybersecurity and Compliance

The Analyst, Cybersecurity and Compliance helps White & Case strengthen its cybersecurity risk posture by identifying, evaluating, and monitoring cybersecurity risks. The role supports core GRC activities, including audit readiness, certifications, vendor risk, compliance reporting, and remediation planning aligned to applicable policies and regulations.

Key Responsibilities

• Support the Sr. Analyst in GRC management principles and practices.
• Assist with internal assessments and audits at scheduled intervals and as needed, to evaluate and validate the design and operational effectiveness of technical and administrative controls.
• Monitor open audit items from internal and external audits tied to compliance, client, or certification requirements; coordinate audit evidence collection to support completion of remediation activities defined in agreed action plans and risk treatment plans.
• Deliver operational reporting for compliance and risk, including control completion, evidence freshness, overdue items, and remediation SLAs; communicate trends to stakeholders.
• Identify and help implement opportunities to automate manual GRC processes using tools including Microsoft Copilot and Power Platform.
• Provide basic to intermediate administration of GRC tooling, including maintaining control libraries, evidence repositories, and task workflows within platforms such as Vanta, Drata, ServiceNow GRC, One Trust, and C1Risk (including user access, templates, and assignments).
• Maintain and prioritize the risk register, ensuring risks include clear statements, likelihood and impact scoring, owners, and remediation plans aligned to business priorities.
• Contribute to the Firm’s business resiliency program by supporting business impact analyses, disaster recovery exercises, updates to business continuity plans, lessons learned documentation, and follow-up action assignment and tracking.
• Partner with Technology teams to define processes that support control intent while matching delivery realities, including CI/CD approvals, IaC reviews, and incident response workflows.
• Coordinate with Legal, Privacy, and Procurement on third-party risk by supporting due diligence intake calls, documenting risks, and following up with internal stakeholders, vendors, and Legal; translate identified risks into MSA mitigation clauses for sensitive data handling or critical services.
• Support security awareness and training by developing role-based courses, conducting quarterly phishing simulations, preparing management reports, and contributing to security awareness communications and content.
• Design, manage, and update compliance-related documentation and reports, and create regulatory compliance road maps as needed.

Required Qualifications

• 3+ years of experience in GRC, specifically related to vendor intake processes or risk management standards and frameworks.
• Possession of, or progress toward, a cybersecurity certification such as CRISC, CISM, CGEIT, CISA, or CISSP.
• Understanding of industry standards, certifications, and regulations including NIST 800-53, CSF 2.0, and ISO 27001.
• Working knowledge of compliance programs including SSAE16 SOC1, SOC2, and PCI.
• GRC tooling knowledge at a basic to intermediate level across platforms such as Vanta, Drata, ServiceNow GRC, One Trust, and C1Risk.
• Experience reviewing secure SDLC lifecycle assessments.
• Working knowledge of enterprise infrastructure and application monitoring tools.
• Proficiency in Microsoft Office applications, with SME-level skills in Excel and PowerBI plus database, dashboarding, and data manipulation capabilities.
• Strong attention to detail and clear logical and analytical thinking.
• Ability to prioritize and manage multiple tasks under pressure.
• Good verbal, written, and numeric communication skills.
• Ability to travel or work overtime as needed.

Technology Stack

Microsoft Copilot, Power Platform, Vanta, Drata, ServiceNow GRC, One Trust, C1Risk, Microsoft Office, Excel, PowerBI, SSAE16, SOC1, SOC2, PCI, NIST 800-53, CSF 2.0, ISO 27001, CI/CD approvals, IaC reviews.

Reporting Line

This role reports to the Senior Manager, Security and Business Continuity.

Team Overview

The Technology Services team supports the Firm’s overall technology, mobile and desktop devices, and core infrastructure to enable reliable, secure, and efficient operations. Technology Services operates globally with representation in each office and shared service centers in Tampa and Manila. The team balances new and innovative technologies with data security and compliance responsibilities, including protection of sensitive client information against cyber threats and business interruption events.

Benefits

• Medical, dental, and vision insurance.
• Life and disability coverage.
• 401(k) retirement savings.
• Vacation time and leave programs (including parental leave).
• Exempt roles are eligible for a performance bonus.

Location and Work Setting

Tampa, FL (onsite).

Equal Employment Opportunity

White & Case is an Equal Employment Opportunity (EEO) employer committed to creating a fair workplace.

Note to Recruitment Agencies

White & Case’s internal Recruitment team manages all aspects of lateral hiring. Agencies must have signed terms of business before submitting candidates. CVs or applications sent directly to White & Case partners or employees will not be considered formal introductions.