Senior GRC Information Security Systems Analyst (Minneapolis, MN; Denver, CO; Salt Lake City, UT; Dallas, TX; Washington, D.C.; Phoenix, AZ; Seattle, WA) (#4073)
Dorsey & Whitney LLP · Dallas, TX · 1 mo ago
HybridInformation Technology$110k–$142k/yrFull-time
We need to output HTML fragment with sections: About the role? Actually the posting includes description. We need to use for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include only sections with real specific content. We need to preserve all substantive info, remove boilerplate, navigation, EEO, etc. Also no job title heading, no Job ID. We need to include sections: About the role (maybe intro paragraph), Responsibilities (list), Requirements (maybe qualifications), Skills (maybe preferred?), Benefits (list), Pay (if mentioned), Schedule (if mentioned). Let's scan posting for pay/schedule: Not mentioned. So we should not include Pay or Schedule sections. Benefits: there is a paragraph about benefits under "About Dorsey". That includes benefits list. So we can include Benefits section with
for section headings like About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We must include only sections with real specific content. We need to preserve all substantive info, remove boilerplate, navigation, EEO, etc. Also no job title heading, no Job ID. We need to include sections: About the role (maybe intro paragraph), Responsibilities (list), Requirements (maybe qualifications), Skills (maybe preferred?), Benefits (list), Pay (if mentioned), Schedule (if mentioned). Let's scan posting for pay/schedule: Not mentioned. So we should not include Pay or Schedule sections. Benefits: there is a paragraph about benefits under "About Dorsey". That includes benefits list. So we can include Benefits section with - . Also maybe "About Dorsey" could be About the role? Actually "About Dorsey" is about the firm, not role. The instruction: Use
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have About the role (intro description of role), Responsibilities (list of duties), Requirements (maybe education/experience), Qualifications (maybe certifications?), Skills (maybe technical skills), Benefits (list). We need to avoid duplication. Let's extract.
Intro: "Join Dorsey’s Information Security team as a Senior GRC Information Security Systems Analyst to help safeguard our firm and clients by driving high-impact security initiatives across audits, risk, governance, and compliance. Reporting directly to the Information Security Systems Manager, you’ll lead and support client and pre-contract security assessments, organize and execute internal ISMS audits and management reviews, maintain current policies and controls aligned to ISO 27001 and other leading frameworks, and oversee authorization services and quarterly NetDocuments access reviews. You’ll partner with stakeholders to deliver cybersecurity consulting projects, validate repeatable RBAC and entitlement processes, and ensure our DLP program meets client, ISO, and regulatory requirements to make a tangible difference in the resilience and trust our clients expect."
That's good for About the role.
Responsibilities: The bullet list after "Key Responsibilities Include". We need to extract each responsibility as list items. Let's parse:
- Support Information Security Systems Manager with the maintenance of Information Security documentation, supporting changes in the organization, technology, or threat landscape.
- Provide Information Security Program reporting related to metrics and dashboards for various Dorsey committees as requested by Information Security Systems Manager.
- Create and oversee the distribution of Bimonthly Information Security communications released Firm wide.
- Collaborate with Firm and Information Services process owners and stakeholders, internal and external assessors and auditors to execute and review risk assessments, internal and external surveillance audits resulting in the recertification (e.g., ISO 27001, GDPR). Document audit findings, remediation action plans and audit report responses.
- Consult with Information Services teams, Dorsey Business Teams and advise on Compliance requirements, and Information Security Standards and Controls.
- Collaborate with Information Services team stakeholders to implement processes that automate and continuously monitor Compliance-related, Information Security Standard controls, and approved exceptions.
- Assist GRC and Information Security management with ISMS continuous operation, monitoring, and improvement of the Information Security Management System (ISMS) by organizing and executing annual internal audits and management reviews.
- Maintain Compliance-related documentation, including policies, procedures, Statement of Applicability, are current and reflect any changes in the organization, technology, or threat landscape.
- Complete Client-generated pre- and post-contract security controls and risk review assessment, audits, in support of Dorsey client requests.
- Review and provide security input into Client RFP Responses. Support Marketing and Business Development teams with RFP response requests as they pertain to Information Security information.
- Perform Dorsey-requested pre-contract security controls and risk review of technology, software, and services.
- Maintain Dorsey SIG Questionnaire and ndMax AI chatbot, collaborating with key Information Services stakeholders for its currency.
- Assist the Information Security Systems Manager with project-based risk assessments, interviewing, collecting data, and documenting risk. May be asked to present risk assessment results to Head of Cybersecurity and CIO for discussion and drive decision-making. Document risk decision in risk register if necessary.
- Maintain Firm Technology Risk Register, provide reporting and coordinate meetings with Information Services Leadership to discuss open risk items and remediation actions.
- Support the Information Security Systems Manager in the creation of an annual Firm-wide Annual Security Awareness Training Program, Human Risk Initiative, with Phish Simulation Testing.
- Support the delivery of a focused 8-week training program for currently hired business professionals, New Hired business professionals training.
- Support the delivery of multi-month, Firm-wide Phish Simulation Testing.
- Prepare Human Risk reporting and update Human Risk Calculations and additional training assigned by the Information Security Systems Manager.
- Execute the project-based enhancement of RBAC, Rights, Permissions, Groups, and Entitlement Definition and Clean-Up for Privileged Accounts (PIM), Service Accounts, and User Accounts, this position will support the ongoing Identity & Authorization Services Compliance Oversight process.
- Execute post-project oversight process will validate the defined, repeatable process being followed to ensure all user, privileged users, and service accounts maintain security to reduce risk of unauthorized access.
- Execute oversight process to ensure assurance is validated, repeatable processes are being followed to ensure all human and nonhuman accounts maintain security that reduce risk of unauthorized access and shrink attack surfaces.
- Perform the quarterly NetDocuments access review as assigned.
- Support the DLP Program Execution and Oversight to ensure the DLP controls meet Client, ISO, Information Governance, and Regulatory requirements.
- May perform other duties not listed above.
We need to keep all substantive info. Some sentences are a bit garbled but we keep as is.
Requirements: The "What We’re Looking For" section includes education and experience. We can split into Requirements (education + years experience) and Qualifications (certifications, preferred). But we can also combine. The instruction: Use headings like Requirements, Qualifications, Skills, Benefits. We'll decide.
Requirements: Bachelor's Degree or equivalent in Business, Computer Science or equivalent experience. At least 7 years of demonstrated experience across three of the following: (list). Also At least 7 years of demonstrated experience spanning the following: (list). Also At least 5-7 years of hands on experience driving IAM enhancements... Also At least 5–7 years of governance and oversight hands on experience executing DLP and Human Risk program enhancement initiatives... Also Excellent written and verbal communication skills; demonstrated experience, communicating and collaborating effectively across business and technology areas. Ability to work independently, excellent organizational and management skills. Ability to manage and prioritize multiple tasks and adapt to needed changes. Knowledge of on-premises and MSFT Azure, M365 Tenant-based technologies and cloud infrastructure platforms (list). That's a lot; we can keep as requirements.
Qualifications: Preferred: At least one certification such as CISSP, CISM, and/or CISA. Prior Legal or Professional Services experience. Informed on information security industry standards and best practices. Microsoft CoPilot and Anthropic Claude AI experience. ISO 42001 knowledge.
Skills: Could be technical skills list: maybe the knowledge of platforms etc. But we already included knowledge in requirements. Could separate: Skills: (list of technical proficiencies). But to avoid duplication, maybe we put Skills as the technical platforms list. However the instruction says prefer a few substantive sections over many thin ones. We could combine Requirements and Qualifications into one section? But headings are suggested; we can include both if they have content.
We need to avoid filler like "commensurate with experience". Not present.
Benefits: list from About Dorsey: comprehensive medical insurance with coverage for infertility, gender-affirming care, behavioral health, and access to virtual providers; dental insurance; vision insurance; 401(k) retirement savings plan with Firm contribution; basic and optional life insurance; short and long-term disability; paid time off; up to 8 weeks of paid parental leave with up to an additional 6-8 weeks of paid short-term disability for business professionals who give birth; paid holidays; paid volunteer day; discretionary bonuses (if bonus eligible); adoption assistance; healthcare, dependent care, and transportation pre-tax reimbursement accounts; back-up child and elder care program; education and college advising program; virtual tutoring; wellbeing programs and activities; mass transit program (certain offices); travel assistance program; 24/7 employee assistance program with access to five confidential visits with a licensed counselor at no cost. (Some benefits are subject to eligibility criteria.)
We'll output as - each.
We must not include boilerplate like EEO, reasonable accommodations, how to apply, etc. Remove those.
Now produce HTML fragment:
About the role
Join Dorsey’s Information Security team as a Senior GRC Information Security Systems Analyst to help safeguard our firm and clients by driving high-impact security initiatives across audits, risk, governance, and compliance. Reporting directly to the Information Security Systems Manager, you’ll lead and support client and pre-contract security assessments, organize and execute internal ISMS audits and management reviews, maintain current policies and controls aligned to ISO 27001 and other leading frameworks, and oversee authorization services and quarterly NetDocuments access reviews. You’ll partner with stakeholders to deliver cybersecurity consulting projects, validate repeatable RBAC and entitlement processes, and ensure our DLP program meets client, ISO, and regulatory requirements to make a tangible difference in the resilience and trust our clients expect.
Responsibilities
- Support Information Security Systems Manager with the maintenance of Information Security documentation, supporting changes in the organization, technology, or threat landscape.
- Provide Information Security Program reporting related to metrics and dashboards for various Dorsey committees as requested by Information Security Systems Manager.
- Create and oversee the distribution of Bimonthly Information Security communications released Firm wide.
- Collaborate with Firm and Information Services process owners and stakeholders, internal and external assessors and auditors to execute and review risk assessments, internal and external surveillance audits resulting in the recertification (e.g., ISO 27001, GDPR). Document audit findings, remediation action plans and audit report responses.
- Consult with Information Services teams, Dorsey Business Teams and advise on Compliance requirements, and Information Security Standards and Controls.
- Collaborate with Information Services team stakeholders to implement processes that automate and continuously monitor Compliance-related, Information Security Standard controls, and approved exceptions.
- Assist GRC and Information Security management with ISMS continuous operation, monitoring, and improvement of the Information Security Management System (ISMS) by organizing and executing annual internal audits and management reviews.
- Maintain Compliance-related documentation, including policies, procedures, Statement of Applicability, are current and reflect any changes in the organization, technology, or threat landscape.
- Complete Client-generated pre- and post-contract security controls and risk review assessment, audits, in support of Dorsey client requests.
- Review and provide security input into Client RFP Responses. Support Marketing and Business Development teams with RFP response requests as they pertain to Information Security information.
- Perform Dorsey-requested pre-contract security controls and risk review of technology, software, and services.
- Maintain Dorsey SIG Questionnaire and ndMax AI chatbot, collaborating with key Information Services stakeholders for its currency.
- Assist the Information Security Systems Manager with project-based risk assessments, interviewing, collecting data, and documenting risk. May be asked to present risk assessment results to Head of Cybersecurity and CIO for discussion and drive decision-making. Document risk decision in risk register if necessary.
- Maintain Firm Technology Risk Register, provide reporting and coordinate meetings with Information Services Leadership to discuss open risk items and remediation actions.
- Support the Information Security Systems Manager in the creation of an annual Firm-wide Annual Security
for section headings (e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule). So we can have About the role (intro description of role), Responsibilities (list of duties), Requirements (maybe education/experience), Qualifications (maybe certifications?), Skills (maybe technical skills), Benefits (list). We need to avoid duplication. Let's extract.
Intro: "Join Dorsey’s Information Security team as a Senior GRC Information Security Systems Analyst to help safeguard our firm and clients by driving high-impact security initiatives across audits, risk, governance, and compliance. Reporting directly to the Information Security Systems Manager, you’ll lead and support client and pre-contract security assessments, organize and execute internal ISMS audits and management reviews, maintain current policies and controls aligned to ISO 27001 and other leading frameworks, and oversee authorization services and quarterly NetDocuments access reviews. You’ll partner with stakeholders to deliver cybersecurity consulting projects, validate repeatable RBAC and entitlement processes, and ensure our DLP program meets client, ISO, and regulatory requirements to make a tangible difference in the resilience and trust our clients expect."
That's good for About the role.
Responsibilities: The bullet list after "Key Responsibilities Include". We need to extract each responsibility as list items. Let's parse:
- Support Information Security Systems Manager with the maintenance of Information Security documentation, supporting changes in the organization, technology, or threat landscape.
- Provide Information Security Program reporting related to metrics and dashboards for various Dorsey committees as requested by Information Security Systems Manager.
- Create and oversee the distribution of Bimonthly Information Security communications released Firm wide.
- Collaborate with Firm and Information Services process owners and stakeholders, internal and external assessors and auditors to execute and review risk assessments, internal and external surveillance audits resulting in the recertification (e.g., ISO 27001, GDPR). Document audit findings, remediation action plans and audit report responses.
- Consult with Information Services teams, Dorsey Business Teams and advise on Compliance requirements, and Information Security Standards and Controls.
- Collaborate with Information Services team stakeholders to implement processes that automate and continuously monitor Compliance-related, Information Security Standard controls, and approved exceptions.
- Assist GRC and Information Security management with ISMS continuous operation, monitoring, and improvement of the Information Security Management System (ISMS) by organizing and executing annual internal audits and management reviews.
- Maintain Compliance-related documentation, including policies, procedures, Statement of Applicability, are current and reflect any changes in the organization, technology, or threat landscape.
- Complete Client-generated pre- and post-contract security controls and risk review assessment, audits, in support of Dorsey client requests.
- Review and provide security input into Client RFP Responses. Support Marketing and Business Development teams with RFP response requests as they pertain to Information Security information.
- Perform Dorsey-requested pre-contract security controls and risk review of technology, software, and services.
- Maintain Dorsey SIG Questionnaire and ndMax AI chatbot, collaborating with key Information Services stakeholders for its currency.
- Assist the Information Security Systems Manager with project-based risk assessments, interviewing, collecting data, and documenting risk. May be asked to present risk assessment results to Head of Cybersecurity and CIO for discussion and drive decision-making. Document risk decision in risk register if necessary.
- Maintain Firm Technology Risk Register, provide reporting and coordinate meetings with Information Services Leadership to discuss open risk items and remediation actions.
- Support the Information Security Systems Manager in the creation of an annual Firm-wide Annual Security Awareness Training Program, Human Risk Initiative, with Phish Simulation Testing.
- Support the delivery of a focused 8-week training program for currently hired business professionals, New Hired business professionals training.
- Support the delivery of multi-month, Firm-wide Phish Simulation Testing.
- Prepare Human Risk reporting and update Human Risk Calculations and additional training assigned by the Information Security Systems Manager.
- Execute the project-based enhancement of RBAC, Rights, Permissions, Groups, and Entitlement Definition and Clean-Up for Privileged Accounts (PIM), Service Accounts, and User Accounts, this position will support the ongoing Identity & Authorization Services Compliance Oversight process.
- Execute post-project oversight process will validate the defined, repeatable process being followed to ensure all user, privileged users, and service accounts maintain security to reduce risk of unauthorized access.
- Execute oversight process to ensure assurance is validated, repeatable processes are being followed to ensure all human and nonhuman accounts maintain security that reduce risk of unauthorized access and shrink attack surfaces.
- Perform the quarterly NetDocuments access review as assigned.
- Support the DLP Program Execution and Oversight to ensure the DLP controls meet Client, ISO, Information Governance, and Regulatory requirements.
- May perform other duties not listed above.
We need to keep all substantive info. Some sentences are a bit garbled but we keep as is.
Requirements: The "What We’re Looking For" section includes education and experience. We can split into Requirements (education + years experience) and Qualifications (certifications, preferred). But we can also combine. The instruction: Use headings like Requirements, Qualifications, Skills, Benefits. We'll decide.
Requirements: Bachelor's Degree or equivalent in Business, Computer Science or equivalent experience. At least 7 years of demonstrated experience across three of the following: (list). Also At least 7 years of demonstrated experience spanning the following: (list). Also At least 5-7 years of hands on experience driving IAM enhancements... Also At least 5–7 years of governance and oversight hands on experience executing DLP and Human Risk program enhancement initiatives... Also Excellent written and verbal communication skills; demonstrated experience, communicating and collaborating effectively across business and technology areas. Ability to work independently, excellent organizational and management skills. Ability to manage and prioritize multiple tasks and adapt to needed changes. Knowledge of on-premises and MSFT Azure, M365 Tenant-based technologies and cloud infrastructure platforms (list). That's a lot; we can keep as requirements.
Qualifications: Preferred: At least one certification such as CISSP, CISM, and/or CISA. Prior Legal or Professional Services experience. Informed on information security industry standards and best practices. Microsoft CoPilot and Anthropic Claude AI experience. ISO 42001 knowledge.
Skills: Could be technical skills list: maybe the knowledge of platforms etc. But we already included knowledge in requirements. Could separate: Skills: (list of technical proficiencies). But to avoid duplication, maybe we put Skills as the technical platforms list. However the instruction says prefer a few substantive sections over many thin ones. We could combine Requirements and Qualifications into one section? But headings are suggested; we can include both if they have content.
We need to avoid filler like "commensurate with experience". Not present.
Benefits: list from About Dorsey: comprehensive medical insurance with coverage for infertility, gender-affirming care, behavioral health, and access to virtual providers; dental insurance; vision insurance; 401(k) retirement savings plan with Firm contribution; basic and optional life insurance; short and long-term disability; paid time off; up to 8 weeks of paid parental leave with up to an additional 6-8 weeks of paid short-term disability for business professionals who give birth; paid holidays; paid volunteer day; discretionary bonuses (if bonus eligible); adoption assistance; healthcare, dependent care, and transportation pre-tax reimbursement accounts; back-up child and elder care program; education and college advising program; virtual tutoring; wellbeing programs and activities; mass transit program (certain offices); travel assistance program; 24/7 employee assistance program with access to five confidential visits with a licensed counselor at no cost. (Some benefits are subject to eligibility criteria.)
We'll output as - each.
We must not include boilerplate like EEO, reasonable accommodations, how to apply, etc. Remove those.
Now produce HTML fragment:
About the role
Join Dorsey’s Information Security team as a Senior GRC Information Security Systems Analyst to help safeguard our firm and clients by driving high-impact security initiatives across audits, risk, governance, and compliance. Reporting directly to the Information Security Systems Manager, you’ll lead and support client and pre-contract security assessments, organize and execute internal ISMS audits and management reviews, maintain current policies and controls aligned to ISO 27001 and other leading frameworks, and oversee authorization services and quarterly NetDocuments access reviews. You’ll partner with stakeholders to deliver cybersecurity consulting projects, validate repeatable RBAC and entitlement processes, and ensure our DLP program meets client, ISO, and regulatory requirements to make a tangible difference in the resilience and trust our clients expect.
Responsibilities
- Support Information Security Systems Manager with the maintenance of Information Security documentation, supporting changes in the organization, technology, or threat landscape.
- Provide Information Security Program reporting related to metrics and dashboards for various Dorsey committees as requested by Information Security Systems Manager.
- Create and oversee the distribution of Bimonthly Information Security communications released Firm wide.
- Collaborate with Firm and Information Services process owners and stakeholders, internal and external assessors and auditors to execute and review risk assessments, internal and external surveillance audits resulting in the recertification (e.g., ISO 27001, GDPR). Document audit findings, remediation action plans and audit report responses.
- Consult with Information Services teams, Dorsey Business Teams and advise on Compliance requirements, and Information Security Standards and Controls.
- Collaborate with Information Services team stakeholders to implement processes that automate and continuously monitor Compliance-related, Information Security Standard controls, and approved exceptions.
- Assist GRC and Information Security management with ISMS continuous operation, monitoring, and improvement of the Information Security Management System (ISMS) by organizing and executing annual internal audits and management reviews.
- Maintain Compliance-related documentation, including policies, procedures, Statement of Applicability, are current and reflect any changes in the organization, technology, or threat landscape.
- Complete Client-generated pre- and post-contract security controls and risk review assessment, audits, in support of Dorsey client requests.
- Review and provide security input into Client RFP Responses. Support Marketing and Business Development teams with RFP response requests as they pertain to Information Security information.
- Perform Dorsey-requested pre-contract security controls and risk review of technology, software, and services.
- Maintain Dorsey SIG Questionnaire and ndMax AI chatbot, collaborating with key Information Services stakeholders for its currency.
- Assist the Information Security Systems Manager with project-based risk assessments, interviewing, collecting data, and documenting risk. May be asked to present risk assessment results to Head of Cybersecurity and CIO for discussion and drive decision-making. Document risk decision in risk register if necessary.
- Maintain Firm Technology Risk Register, provide reporting and coordinate meetings with Information Services Leadership to discuss open risk items and remediation actions.
- Support the Information Security Systems Manager in the creation of an annual Firm-wide Annual Security
About the role
Join Dorsey’s Information Security team as a Senior GRC Information Security Systems Analyst to help safeguard our firm and clients by driving high-impact security initiatives across audits, risk, governance, and compliance. Reporting directly to the Information Security Systems Manager, you’ll lead and support client and pre-contract security assessments, organize and execute internal ISMS audits and management reviews, maintain current policies and controls aligned to ISO 27001 and other leading frameworks, and oversee authorization services and quarterly NetDocuments access reviews. You’ll partner with stakeholders to deliver cybersecurity consulting projects, validate repeatable RBAC and entitlement processes, and ensure our DLP program meets client, ISO, and regulatory requirements to make a tangible difference in the resilience and trust our clients expect.
Responsibilities
- Support Information Security Systems Manager with the maintenance of Information Security documentation, supporting changes in the organization, technology, or threat landscape.
- Provide Information Security Program reporting related to metrics and dashboards for various Dorsey committees as requested by Information Security Systems Manager.
- Create and oversee the distribution of Bimonthly Information Security communications released Firm wide.
- Collaborate with Firm and Information Services process owners and stakeholders, internal and external assessors and auditors to execute and review risk assessments, internal and external surveillance audits resulting in the recertification (e.g., ISO 27001, GDPR). Document audit findings, remediation action plans and audit report responses.
- Consult with Information Services teams, Dorsey Business Teams and advise on Compliance requirements, and Information Security Standards and Controls.
- Collaborate with Information Services team stakeholders to implement processes that automate and continuously monitor Compliance-related, Information Security Standard controls, and approved exceptions.
- Assist GRC and Information Security management with ISMS continuous operation, monitoring, and improvement of the Information Security Management System (ISMS) by organizing and executing annual internal audits and management reviews.
- Maintain Compliance-related documentation, including policies, procedures, Statement of Applicability, are current and reflect any changes in the organization, technology, or threat landscape.
- Complete Client-generated pre- and post-contract security controls and risk review assessment, audits, in support of Dorsey client requests.
- Review and provide security input into Client RFP Responses. Support Marketing and Business Development teams with RFP response requests as they pertain to Information Security information.
- Perform Dorsey-requested pre-contract security controls and risk review of technology, software, and services.
- Maintain Dorsey SIG Questionnaire and ndMax AI chatbot, collaborating with key Information Services stakeholders for its currency.
- Assist the Information Security Systems Manager with project-based risk assessments, interviewing, collecting data, and documenting risk. May be asked to present risk assessment results to Head of Cybersecurity and CIO for discussion and drive decision-making. Document risk decision in risk register if necessary.
- Maintain Firm Technology Risk Register, provide reporting and coordinate meetings with Information Services Leadership to discuss open risk items and remediation actions.
- Support the Information Security Systems Manager in the creation of an annual Firm-wide Annual Security