Director Technology Risk Management Jobs in Clearwater, FL

We are a firm that strives for the highest standards of performance and success. This position, based in the firm’s global operations center in Tampa, FL, seeks an IT Enterprise Risk Analyst to join our team. The role manages the firm’s GRC and IT risk programs, focusing on information security for client data, attorney work, and privileged communications.

• Policy, Standards and Governance: support development, review, and maintenance of information security and technology risk policies, standards, procedures, and guidance documents; maintain policy‑lifecycle processes, stakeholder reviews, approvals, version control; map policies to ISO, NIST, CIS, SOC2, HIPAA, GLBA, GDPR, CCPA, CPRA, and client Outside Counsel Guidelines; administer policy exceptions and risk acceptance workflows; contribute to awareness materials and operative guidance.
• Information Security and Technology Risk Management: conduct or facilitate risk assessments for applications, infrastructure, cloud services, and firm‑critical legal‑industry platforms; maintain risk register, including inherent and residual ratings and treatment plans; partner with control owners for remediation; support risk monitoring, key risk indicators, and control health metrics; draft risk reporting for governance forums; support incident response activities and post‑incident lessons learned.
• Vendor/Third‑Party Risk Management (TPRM): perform third‑party security due diligence based on vendor criticality and risk tiering; coordinate security questionnaires and evidence collection; review SOC reports, ISO certificates, penetration test summaries, and other assurance artifacts; identify gaps, recommend remediation, track vendor action plans; partner with Procurement/Legal on contract security requirements; support periodic vendor reassessments; draft responses to inbound client security questionnaires.
• Audit, Assurance and Compliance: support internal and external audits by coordinating evidence collection, control walkthroughs, and audit responses; assist with gap assessments and control testing against ISO27001/27002, NIST CSF/SP800‑53/800‑171, SOC2, GLBA, HIPAA, GDPR, NIS2, and CUI/ITAR/EAR requirements; track audit findings and corrective action plans; maintain audit artifacts; support EU compliance activities and controlled unclassified information (CUI) handling; compile control attestations for cyber‑insurance applications.

Maintain a regular and predictable work schedule and full attention during business hours, except as otherwise approved or required by law.

• Strong written and verbal communication skills, ability to translate control requirements into clear documentation and actionable guidance.
• Strong organizational skills, meticulous attention to detail, and the ability to manage multiple priorities and deadlines.
• Knowledge or ability to learn Microsoft Office Suite or Microsoft365.

• Bachelor’s degree in information security, information technology, risk management, business, or equivalent practical experience.
• 3+ years of experience in GRC, information security, technology risk management, compliance, internal audit, or third‑party risk management.
• Working knowledge of ISO/IEC27000 family, NIST CSF/SP800‑53/800‑171, and HIPAA.
• Familiarity with EU information security and privacy requirements (e.g., GDPR) and NIS2 concerns.
• Experience collecting, organizing, and validating control evidence and supporting audits/assessments.
• Certifications: ISACA CRISC and/or CISA.

• Prior exposure to GRC, IT risk, or information security work in a law firm, professional services firm, or client‑confidential environment.
• Familiarity with legal‑industry technology (e.g., iManage, NetDocuments, 3E, Aderant, Intapp, Relativity) and data‑sensitivity considerations.
• Awareness of ABA Model Rules of Professional Conduct (Rules1.1 and1.6) and applicable state bar requirements.
• Familiarity with CUI handling, NIST SP800‑171, CMMC, and ITAR/EAR data‑handling; prior exposure to federal, defense, or government‑contract client matters.
• Certifications: ISACA COBITFoundation, CDPSE, CGEIT; ISO/IEC27001 internal auditor, lead implementer, or lead auditor; cloud/platform risk certifications (Microsoft SC‑900, AZ‑500, etc.).

Ability to sit or stand for extended periods; moderate to advanced keyboard usage.

• Medical (PPO and HDHPs), dental and vision plans; life and AD&D insurance; short‑ and long‑term disability insurance.
• Tax‑advantaged health accounts (FSA, HSA), dependent‑care FSA; health advocacy services; behavioral health and counseling resources for all family members.
• 401(k) and profit‑sharing; backup dependent care; senior care planning support; paid holidays and other paid time off, including paid leave for new parents.

Holland & Knight is an Equal Opportunity Employer and does not discriminate on the basis of race, color, religion, sex (including pregnancy, childbirth or related conditions, transgender status and sexual orientation), national origin, age, disability, genetic information, veteran status or any other factor prohibited by law. Applicants who require accommodations during the application process should contact ApplicantAccommodations@hklaw.com.