Job Description:

Description & Requirements

The Information Security Governance, Risk and Assurance Analyst will work closely with stakeholders across Technology, Information Security, Risk and Procurement teams to support the Firms information security governance, risk, compliance and assurance objectives.

The role holder will be responsible for conducting risk-based IT audits, security assessments, third-party risk reviews and governance activities, ensuring alignment with the Firms security framework, policies and applicable standards. They will also support the ongoing development of the third-party risk programme, helping to strengthen supplier assurance, onboarding processes and integration governance.

Main responsibilities:

- Plan and execute risk-based IT and information security audits, control assessments and compliance reviews across internal functions, technology platforms, business processes and third parties.
- Assess control design and operating effectiveness across governance, access management, change management, IT operations, cloud, network and endpoint security, data protection, secure development, incident management, resilience, supplier management and compliance.
- Define scope, objectives, test procedures, evidence requirements and sampling approaches with relevant stakeholders.
- Produce clear, defensible workpapers and reports documenting evidence, control gaps, root causes, risk implications and practical recommendations.
- Maintain findings and corrective-action records, validate remediation, track actions to closure and elevate overdue or material issues.
- Support internal and external audits, client security assessments,



regulatory reviews and assurance requests by coordinating evidence and providing accurate, consistent responses.
- Respond to RFPs, RFIs, due diligence questionnaires and contractual security enquiries supporting business development and client onboarding.
- Perform security due diligence and manage risk activities across the third-party lifecycle, including intake, classification, assessment, contracting support, onboarding, monitoring, periodic review, issue management and offboarding.
- Improve vendor assessment and onboarding cycle times through risk-based scoping, clear evidence requirements, stakeholder coordination and timely escalation of blockers.
- Coordinate annual and periodic reviews of critical and high-risk vendors and maintain a forward review schedule.
- Monitor critical suppliers, investigate material alerts and track vendor remediation to closure.
- Maintain complete, accurate and audit-ready inventories, risk records, evidence, review dates, findings, exceptions and remediation status.
- Work with Procurement, Legal, Privacy, Compliance, Technology, business owners and suppliers to identify and manage third-party risk.
- Support governance of third-party integrations, connected applications, APIs and data exchanges, including ownership, inventory, security, privacy, authentication, authorization, logging, monitoring, resilience and lifecycle controls.




- Identify unmanaged or insufficiently governed integrations and APIs, assess risk and coordinate remediation or formal risk acceptance.
- Monitor compliance with information security policies, standards and procedures and contribute to continual improvement of the ISMS and risk framework.
- Develop metrics, KPIs, KRIs, dashboards and risk-based recommendations covering audits, assessments, vendor onboarding, review cycle times, monitoring, findings and remediation.
- Improve policies, standards, procedures, control descriptions, assessment methods, templates and guidance, and identify opportunities to streamline or automate GRC processes without reducing control quality.

Skills and experience:

- Strong understanding of information security, technology risk, governance, compliance, audit and control principles.
- Demonstrable experience planning or performing IT or information security audits, risk assessments, control testing or compliance reviews.
- Authoritative knowledge of audit principles across governance, asset management, identity and access management, change management, IT operations, cloud and network security, secure development, incident management, resilience, supplier management and compliance.
- Experience conducting third-party security due diligence and supporting vendor risk management across onboarding, periodic review, continuous monitoring, issue management and offboarding.
- Experience improving assessment workflows, coordinating stakeholders and delivering work to defined service levels or target dates.
- Working knowledge of third-party integration and API risks, including ownership, inventory, authentication, authorization, dat

📌 Senior IT Audit Risk And Security Governance Analyst (Buenos Aires)
🏢 Baker McKenzie
📍 Buenos Aires