Senior GRC Information Security Systems Analyst (Minneapolis, MN; Denver, CO; Salt Lake City, UT; New York, NY; Washington, D.C.; Phoenix, AZ; Seattle, WA) (#4073)

We need to output HTML fragment with sections: About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. Only include sections that have real specific content. The posting includes description of role, responsibilities, requirements, qualifications, skills, benefits. No explicit Pay or Schedule. So we should not include Pay or Schedule sections. Also need to avoid repeating job title as heading. Use

for each section heading. Use

• for lists. Use

  for prose. We must preserve all substantive information, not invent or summarize away detail. Remove boilerplate: cookie/navigation/legal/EEO/equal-opportunity/scam-warning, duplicated lines, application instructions. Also remove "How To Apply" etc. Also remove "About Dorsey" maybe? That's about the firm, could be considered part of "About the role"? Actually "About Dorsey" is about the firm, not role. The instruction: "Prefer a few substantive sections over many thin ones." We could include About Dorsey as part of "About the role"? But they said use headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we should not add a heading for About Dorsey unless we map it to About the role? The role description includes "Join Dorsey’s Information Security team as a Senior GRC Information Security Systems Analyst to help safeguard our firm and clients..." That's about the role. The "About Dorsey" paragraph is about the firm; could be considered part of About the role? Might be better to include it under About the role as prose. We'll include that content. We need to extract responsibilities list: many bullet-like sentences. We'll turn them into

  • . Requirements: list of experience and education. Qualifications: maybe overlapping with requirements; but we can combine? The instruction: prefer few substantive sections. Could combine Requirements and Qualifications into one? But they said use those headings if content exists. We have both Requirements and Qualifications sections in the posting: "What We’re Looking For" includes education, experience, etc. Then "Preferred" includes certifications, etc. So we can treat Requirements as the mandatory qualifications, and Qualifications as preferred? Or we could have Requirements (mandatory) and Qualifications (preferred). We'll follow that. Skills: maybe we can extract technical skills: knowledge of on-premises and MSFT Azure, M365, etc. Also communication skills, etc. We'll put those under Skills. Benefits: we have a paragraph about Dorsey’s benefit package. Include that. We must not include Pay or Schedule. We must not include duplicated lines. Ensure we preserve all substantive info. Let's extract. First, About the role: combine the introductory paragraph and maybe the "About Dorsey" paragraph? Actually "About Dorsey" is separate. We'll include both under About the role? Might be okay. Let's draft:

    About the role

    Join Dorsey’s Information Security team as a Senior GRC Information Security Systems Analyst to help safeguard our firm and clients by driving high-impact security initiatives across audits, risk, governance, and compliance. Reporting directly to the Information Security Systems Manager, you’ll lead and support client and pre-contract security assessments, organize and execute internal ISMS audits and management reviews, maintain current policies and controls aligned to ISO 27001 and other leading frameworks, and oversee authorization services and quarterly NetDocuments access reviews. You’ll partner with stakeholders to deliver cybersecurity consulting projects, validate repeatable RBAC and entitlement processes, and ensure our DLP program meets client, ISO, and regulatory requirements to make a tangible difference in the resilience and trust our clients expect.

    Dorsey & Whitney is a global law firm with over 650 lawyers across 22 offices in the United States, Canada, Europe and Asia. We provide strategic legal counsel to companies worldwide across a diverse range of industries, including banking & financial institutions; development & infrastructure; energy & natural resources; food, beverage & agribusiness; healthcare & life sciences; and technology. Dorsey offers opportunities for advancement within a collaborative and dynamic environment, with competitive pay and excellent benefits.

    Now Responsibilities: list all responsibilities from "Key Responsibilities Include" and the subsequent sentences. We'll break into items. Let's extract each responsibility sentence: - Support Information Security Systems Manager with the maintenance of Information Security documentation, supporting changes in the organization, technology, or threat landscape. - Provide Information Security Program reporting related to metrics and dashboards for various Dorsey committees as requested by Information Security Systems Manager. - Create and oversee the distribution of Bimonthly Information Security communications released Firm wide. - Collaborate with Firm and Information Services process owners and stakeholders, internal and external assessors and auditors to execute and review risk assessments, internal and external surveillance audits resulting in the recertification (e.g., ISO 27001, GDPR). Document audit findings, remediation action plans and audit report responses. - Consult with Information Services teams, Dorsey Business Teams and advise on Compliance requirements, and Information Security Standards and Controls. - Collaborate with Information Services team stakeholders to implement processes that automate and continuously monitor Compliance-related, Information Security Standard controls, and approved exceptions. - Assist GRC and Information Security management with ISMS continuous operation, monitoring, and improvement of the Information Security Management System (ISMS) by organizing and executing annual internal audits and management reviews. - Maintain Compliance-related documentation, including policies, procedures, Statement of Applicability, are current and reflect any changes in the organization, technology, or threat landscape. - Complete Client-generated pre- and post-contract security controls and risk review assessment, audits, in support of Dorsey client requests. - Review and provide security input into Client RFP Responses. Support Marketing and Business Development teams with RFP response requests as they pertain to Information Security information. - Perform Dorsey-requested pre-contract security controls and risk review of technology, software, and services. - Maintain Dorsey SIG Questionnaire and ndMax AI chatbot, collaborating with key Information Services stakeholders for its currency. - Assist the Information Security Systems Manager with project-based risk assessments, interviewing, collecting data, and documenting risk. May be asked to present risk assessment results to Head of Cybersecurity and CIO for discussion and drive decision-making. Document risk decision in risk register if necessary. - Maintain Firm Technology Risk Register, provide reporting and coordinate meetings with Information Services Leadership to discuss open risk items and remediation actions. - Support the Information Security Systems Manager in the creation of an annual Firm-wide Annual Security Awareness Training Program, Human Risk Initiative, with Phish Simulation Testing. - Support the delivery of a focused 8-week training program for currently hired business professionals, New Hired business professionals training. - Support the delivery of multi-month, Firm-wide Phish Simulation Testing. - Prepare Human Risk reporting and update Human Risk Calculations and additional training assigned by the Information Security Systems Manager. - Execute the project-based enhancement of RBAC, Rights, Permissions, Groups, and Entitlement Definition and Clean-Up for Privileged Accounts (PIM), Service Accounts, and User Accounts, this position will support the ongoing Identity & Authorization Services Compliance Oversight process. - Execute post-project oversight process will validate the defined, repeatable process being followed to ensure all user, privileged users, and service accounts maintain security to reduce risk of unauthorized access. - Execute oversight process to ensure assurance is validated, repeatable processes are being followed to ensure all human and nonhuman accounts maintain security that reduce risk of unauthorized access and shrink attack surfaces. - Perform the quarterly NetDocuments access review as assigned. - Support the DLP Program Execution and Oversight to ensure the DLP controls meet Client, ISO, Information Governance, and Regulatory requirements. - May perform other duties not listed above. We'll put each as
  • . Now Requirements: from "What We’re Looking For" bullet points. - Bachelor's Degree or equivalent in Business, Computer Science or equivalent experience. - At least 7 years of demonstrated experience across three of the following: - Implementing or maintaining an Information Security Management System (ISMS) aligned to one or more of the following compliance frameworks: ISO, ISO 27001:2022, SOC2, GDPR, NIST Cybersecurity Framework (CSF), or NIST 800-53. - Implementing or maintaining information security policies, standards, controls, guidelines, and procedures in one or more of the following compliance frameworks: ISO 27001:2022, SOC2, GDPR, NIST Cybersecurity Framework (CSF), or NIST 800-53. - Client-request assessment, audit experience and IT/Security technology, software security risk assessment reviews. - Similar technology/information security focused experience with minimum of 7 years' experience with at least three of the following core areas: - Compliance and security function. - Information security risk management and risk frameworks. - Client IT/security governance and audit. - Security awareness training programs. - At least 7 years of demonstrated experience spanning the following: - Successful planning, preparing, and delivery of audit (re)certification, authorization of in-scope technology asset compliance environments and boundaries. - Performing client security risk assessments, RFP Cybersecurity responses, contract reviews, and data privacy agreements. - Performing Third-Party Vendor Technology and Service Security Risk Assessments and ongoing Monitoring. - Hands-on experience defining, implementing, and maintaining annual information security training program including annual program definition of annual training, technical team role-specific training, phish simulation training program definition and its execution, and reporting. - At least 5-7 years of hands on experience driving IAM enhancements using automation and tooling across hybrid AD/Entra hybrid environments, including group and role analysis, AD permission cleanup, RBAC design and implementation, least privilege enforcement, privileged access reduction, and integration of IAM with HR and IT lifecycle workflows. - At least 5–7 years of governance and oversight hands on experience executing Data Loss Prevention (DLP) and Human Risk program enhancement initiatives, including defining data in scope, implementing data classification and tagging, DLP policies and alerting requirements, performing initial analysis of data flows and risks, and partnering with SOC, IT, and business teams to ensure ongoing compliance and control effectiveness. - Excellent written and verbal communication skills; demonstrated experience, communicating and collaborating effectively across business and technology areas. - Ability to work independently, excellent organizational and management skills. - Ability to manage and prioritize multiple tasks and adapt to needed changes. - Knowledge of on-premises and MSFT Azure, M365 Tenant-based technologies and cloud infrastructure platforms (e.g., Microsoft Azure, Microsoft 365, Microsoft AD & Entra, Microsoft Purview, OneDrive, TEAMS, Sentinel, Microsoft Defender, Exchange Online, Exchange On-Prem, Zoom, Document Management Systems, SSO, OAuth) and SaaS-based application frameworks to evaluate key information security requirements, controls, risk areas. Now Qualifications (Preferred): - At least one certification such as CISSP, CISM, and/or CISA. - Prior Legal or Professional Services experience. - Informed on information security industry standards and best practices. - Microsoft CoPilot and Anthropic Claude AI experience. - ISO 42001 knowledge. Now Skills: maybe we can separate technical skills from soft skills? But we already have communication skills etc in Requirements. Could create Skills section for technical proficiencies: knowledge of on-premises and MSFT Azure, M365, etc. Also maybe "Ability to work independently" etc is more ability than skill. But we can keep Skills for technical proficiencies: knowledge of on-premises and MSFT Azure, M365 Tenant-based technologies and cloud infrastructure platforms (list). Also maybe "Experience with IAM enhancements", "DLP and Human Risk program". But those are already in Requirements. To avoid duplication, we could put those under Requirements and not repeat. But we need to preserve all substantive info; duplication is okay if it's already there? The instruction: "Preserve ALL substantive information; do NOT invent or summarize away detail." Duplication is not prohibited