Senior IT Risk and Compliance Analyst

Morningstar•Chicago, IL

1d•Hybrid

About The Position

The Group: The Information Security department is responsible for setting enterprise security policies and standards that are designed to protect the confidentiality, integrity and availability of Morningstar information. The security team offers guidance and technical expertise in areas like application security, policies and procedures, disaster recovery and compliance/regulation. We analyze emerging security threats and conduct risk and vulnerability assessments to ensure that our information remains secure. The Role: The Information Security Team is looking for a Senior Analyst Third-Party Vendor Risk Analyst to join the IT Compliance Team. The Senior Third-Party Vendor Risk Analyst will help shape the Information Security Team’s third party vendor risk management program. This individual will serve as a subject matter expert for third party vendor risk management, perform vendor risk assessments, propose updates to expand the program’s capabilities, increase participation in the program and drive process improvements. This position is based in either our Chicago or Toronto office.

Requirements

A bachelor’s degree and 5+ years’ experience include 3+ in a vendor risk related role
Experience serving as the subject matter expert for security vendor due diligence
Experience performing contract review of security terms
Familiarity with common compliance standards (SOX, SOC2, PCI-DSS, GDPR etc.)
Familiarity with security frameworks (ISO 27001, NIST, etc.) and general security concepts
Strong organizational skills and the ability to multitask and switch priorities with short notice
Strong business analysis, research and analytical skills
Excellent communication skills

Responsibilities

Partner with the business to execute vendor risk assessments
Monitor internal SLAs to ensure we provide timely service to our internal stakeholders
Serve as a subject matter expert for security vendor risk management
Collaborate with the procurement department and other internal stakeholders to improve and expand the vendor risk management program
Review third party security documents (SOC2, security policies, data flow diagrams, etc.)
Perform contract reviews of proposed changes to security requirements in our third party contracts
Liaise with third party vendors as required

Benefits

100% 401k match up to 6% of salary
Stock Ownership Potential
Company provided life insurance - 1x salary + commission
Comprehensive health benefits (medical/dental/vision) including potential premium discounts and company-provided HSA contributions (up to $500-$2,000 annually) for specific plans and coverages
Additional medical Wellness Incentives - up to $300-$600 annual
Company-provided long- and short-term disability insurance
Trust-Based Time Off
6-week Paid Sabbatical Program
6-Week Paid Family Caregiving Leave
Competitive 8-24 Week Paid Parental Leave
Adoption Assistance
Leadership Coaching & Formal Mentorship Opportunities
Annual Flex Stipend - $1000 annually to cover personal education & well-being expenses
Tuition Reimbursement
Charitable Matching Gifts program
Dollars for Doers volunteer program
Paid volunteering days
15+ Employee Resource & Affinity Groups