Senior Security Risk & Compliance Analyst

Audit & Compliance

• Support the planning, coordination, and execution of compliance audits, including readiness assessments and external audit engagements
• Partner with control owners to document, implement, and maintain compliance controls aligned control requirements.
• Collect, review, and validate audit evidence to ensure completeness and accuracy
• Track audit findings, exceptions, and remediation efforts through closure
• Act as a liaison between internal stakeholders and external auditors

Internal Audit

• Perform internal audits and control assessments to evaluate the effectiveness of security and compliance controls
• Develop audit plans, testing procedures, and audit reports
• Identify control gaps and recommend remediation actions
• Monitor and track remediation efforts to ensure timely resolution

GRC Platform Management

• Administer and maintain the organization’s GRC platform
• Configure audit workflows and maintain accurate, up-to-date due diligence responses within the GRC platform.
• Ensure data integrity and accuracy within the system
• Generate dashboards and reports for compliance status, audit tracking, and risk posture

Risk Registration & Management

• Maintain the enterprise risk register, including identification, classification, and documentation of risks
• Facilitate risk assessments with business and IT stakeholders
• Evaluate risk severity based on likelihood and impact
• Track risk treatment plans (remediation, acceptance, transfer, avoidance)
• Provide regular reporting on risk posture to leadership

Governance & Cross-Functional Collaboration

• Collaborate with IT, Security, Legal, and business units to ensure alignment with compliance requirements
• Assist in the development and maintenance of security policies, standards, and procedures
• Support other compliance initiatives as needed (e.g., regulatory, customer security questionnaires)

• Bachelor’s degree in Information Security, Information Systems, or related field (or equivalent experience)
• At least 5 years of experience in security compliance, audit, or GRC
• Hands-on experience with SOC 2 audits and Trust Services Criteria and New York 23 NYCRR 500, or other regulatory compliance.
• Experience with performing internal audits and control testing
• Familiarity with GRC tools (e.g., ServiceNow GRC, Archer GRC)
• Strong understanding of risk management principles and frameworks
• Knowledge of common frameworks (e.g., AICPA SOC 2, ISO 27001, NIST)
• Experience with leading cybersecurity due diligence activities, including responding to customer and partner security questionnaires accurately and in a timely manner
• Strong analytical, organizational, and communication skills

• Certified Information Systems Auditor (CISA) or
• Certified in Risk and Information Systems Control (CRISC) or
• Certified Information Systems Security Professional (CISSP)

At APCO, the way we work matters just as much as the results we deliver. Our values guide how we work, how we partner, and how we deliver results.

We C.A.R.E.

Committed – We build strong, high-trust relationships with our partners and each other.

Accountable – We take ownership of outcomes and hold ourselves to the highest standards of performance and integrity.

Results-Driven – We focus on delivering measurable outcomes that create value for our partners and our business.

Excellent – We strive for excellence in everything we do while balancing short-term performance with long-term success.

If you're excited about joining a team that values collaboration, accountability, and continuous improvement, we'd love to hear from you.