Specialist, Risk Management

Summary

In this role, the Risk Management Specialist III will support and strengthen our risk management and information security programs. You’ll help ensure the organization maintains effective protections across regulatory, contractual, and data privacy requirements while partnering cross-functionally to identify, assess, and mitigate risk.

You’ll contribute to key initiatives including information security, vendor and project risk assessments, compliance frameworks (e.g., ISO 27001), and policy development, helping to drive continuous improvement and operational maturity. This role offers the opportunity to build hands-on experience in a collaborative environment while acting as a trusted partner to stakeholders across Lega, ICT, and the broader business.

Scope & Responsibilities

Information Security

• Supports the deployment and continuous improvement of information security policies, standards, and technical controls
• Coordinates Prosci’s ISO 27001:2022 certification and audit activities, including audit scheduling, evidence collection, and external auditor coordination
• Administers compliance tooling (e.g., Vanta) to support the information security program and control monitoring
• Facilitates ISMS Governance Council activities, including maintaining the enterprise risk register and reporting on risk posture
• Conducts information security risk assessments for vendors, projects, and business changes
• Tracks, reports, and supports remediation of identified control gaps and audit findings
• Defines and monitors information security metrics to measure program effectiveness and progress
• Serves as a trusted advisor to stakeholders, partnering cross-functionally to support secure business practices

Data Privacy

• Supports the implementation and ongoing management of Prosci’s global data privacy program
• Ensures alignment with applicable global privacy regulations (e.g., GDPR, CCPA, PIPEDA, LGPD) and monitors compliance across business practices
• Partners with Legal and internal stakeholders to interpret and apply privacy requirements to business operations
• Coordinates data subject request (DSR) processes and response activities
• Maintains internal privacy policies and external privacy notices
• Supports employee privacy training and awareness initiatives

PCI Compliance

• Supports the PCI DSS compliance program for outsourced, card-not-present payments under SAQ A scope.
• Maintains documentation of PCI scope and ensures ongoing eligibility for SAQ A classification.
• Oversees third-party service providers (TPSPs), including maintaining vendor inventories and monitoring compliance status
• Supports completion of PCI assessments (SAQ A), including evidence collection, remediation tracking and reporting
• Provides guidance and training to internal stakeholders on PCI requirements and secure payment practices
• Serves as a point of contact for PCI compliance activities and coordination with internal and external

Client Assurance

• Partners with internal stakeholders to understand client security and privacy requirements and expectations
• Supports client assurance activities, including responding to security questionnaires and sharing relevant compliance documentation (e.g., ISO certifications)

Risk Evaluation

• Supports the development and execution of a structured risk evaluation process for projects and business changes
• Reviews initiatives for information security and data privacy risks and escalates findings as appropriate
• Provides regular updates to governance forums on risk posture and emerging concerns

Competencies, Skills & Qualifications

Competencies

• Communicates Effectively - Strong communication skills
• Plans and Aligns
• Respond timely to tasks/requests
• Ability to work independently and prioritize multiple risks and adapt to needed changes
• Balances Stakeholders - Ability to work with all levels of management/team members
• Decision Quality
• A need to assume responsibility for work
• Ability to pull together disparate pieces of information to analyze risk.
• Knowledge of and proven ability for attention to detail and strong organizational skills
• Analytical thinker
• A drive to exceed goals

Qualifications

• 4 – 7 years’ experience in Risk Management, including knowledge of US/international data privacy regulations, implementation for/maintenance of ISO certification 27001 certification, risk evaluation of new projects and vendors, creation of risk management solutions, review of client DPA and security agreements, and related matters.
• Bachelor’s degree
• CIPM Certification