Allegiant Air

Low-cost, all-jet leisure travel carrier

Risk & Compliance Analyst 2 - Third-Party Risk Management

Security Governance, Risk & ComplianceConfirmed live in the last 24 hours

Full-time$102.4k - $124.8k /yr

About the Job

Requirements

A bachelor's degree in a related field.
At least four years of experience in Internal Audit (IT Audit preferred), IT Risk, or Information Security.
Knowledge of project management skills, including task identification, prioritization, and documentation.
Ability to balance multiple responsibilities that may frequently change.
Ability to learn information quickly and apply risk and control considerations that affect downstream decisions.
Ability to interface effectively with internal and external auditors.
Critical thinking skills, attention to detail, and follow-up.
High degree of professionalism and personal integrity.
Ability to work independently.
Strong documentation skills for processes, controls, policies, and risks.
Verbal and written communication skills across all levels of personnel, including executive management and the Board of Directors.
Knowledge and experience performing ongoing risk analysis to determine which customer services, supporting business processes, systems, components, and applications must be recovered, and within what timeframe, to comply with recovery time objectives.
Familiarity with the internet, networking (LAN and WAN), data and voice telecommunications, and cloud computing to assist in preparing recovery procedures.
Knowledge of industry best practices, including ISO 27001 and PCI DSS.
Knowledge of TCP/IP and related protocols.
Familiarity with intrusion detection and prevention techniques, and ability to research security issues and products.
Familiarity with risk management and control frameworks such as COBIT, ISO 27005, COSO, NIST 800-30, and ITIL.
Understanding of internal audit and risk-based methodologies.
Experience with Sarbanes-Oxley (SOX).
Understanding and experience with NIST and PCI standards.
Strong experience in IT Audit, IT Risk, and/or Information Security.
Proficiency in assessing risk and risk management practices.
Knowledge of IT policies, standards, procedures, security frameworks, and their development and implementation.
Hands-on experience with OneTrust Third-Party Risk Management, including third-party intake, assessment workflows, questionnaires, issues, remediation tracking, reporting, and ongoing monitoring.
Understanding of end-to-end third-party risk management processes, including intake and scoping, inherent risk assessment, due diligence, control assessment, residual risk determination, risk treatment, ongoing monitoring, reassessment, and offboarding.
Ability to identify and evaluate third-party risks and controls across information security, privacy, access management, vulnerability management, incident management, business continuity and disaster recovery, regulatory compliance, and data protection.
Experience documenting control gaps, risk findings, compensating controls, residual risk, remediation plans, and formal risk acceptance decisions.
Understanding of risk treatment options, including mitigation, remediation, transfer, avoidance, and acceptance, and ability to recommend treatment based on risk severity and business context.
Ability to lead multiple concurrent third-party assessments and coordinate deliverables with vendors, business owners, Information Security, Privacy, Legal, Procurement, and other stakeholders.
Ability to review vendor evidence and determine whether controls are appropriately designed and implemented.
Documentation skills for concise and defensible risk narratives, assessment conclusions, issue statements, action plans, and executive-level reporting.
Verbal and written communication skills for technical and nontechnical audiences, including leadership and external vendors.
Ability to work independently, prioritize changing demands, follow up on open issues, and drive risk treatment activities to completion.
Knowledge of relevant frameworks and standards, including NIST, ISO 27001, PCI DSS, SOC 2, COBIT, and applicable privacy requirements.
Experience with IT risk, information security, internal audit, procurement, vendor management, or compliance programs.
Experience with Sarbanes-Oxley (SOX) and PCI DSS.
Understanding and experience with NIST and PCI DSS.
Knowledge of IT policies, standards, procedures, security frameworks, and their development and implementation.

Responsibilities

Participate in all areas of IT Governance, Risk, and Compliance.
Perform IT risk assessments, identify risks presented by technological and process changes, and review supporting processes and procedures to ensure appropriate controls are in place and risks are mitigated.
Gather relevant business, regulatory, process, and system information; validate and update process flows, risks, and controls; and prepare accurate, complete, clear, and timely analysis and documentation that identifies risks and independently assesses the adequacy and effectiveness of IT internal controls, policies, processes, and procedures.
Maintain the risk register and support continuous improvement of IT risk management processes.
Work with management and team members to assess risks associated with technology solutions and ensure appropriate remediation strategies are employed; consult with managers and team members to identify and assess current and emerging risks and strategic initiatives.
Support IT audits and regulatory examinations.
Write effective controls and action plans for deficiencies.
Assist in developing IT Risk and Compliance risk metric and reporting frameworks, and deliver metrics and reports weekly, monthly, and quarterly.
Manage testing request lists from internal and external auditors and serve as the interface between IT management and auditors.
Define action plans and timelines with process owners and manage them through completion and implementation.
Investigate, document, and report information security incidents that impact confidentiality, integrity, or availability.
Support administration of IT policies, standards, and procedures; ensure they meet established guidelines and are housed, refreshed, inventoried, and approved.
Draft information security deliverables for internal and external partners on topics including security breaches and policy governance.
Conduct scheduled assessments to identify gaps in IT business continuity, emergency, and disaster recovery plans.
Maintain and update plans and practices for effective communication and restoration of operations during IT emergencies.
Coordinate the IT disaster recovery team in scheduling disaster recovery and failover tests to ensure critical applications are tested against recovery standards.
Participate in IT business continuity planning awareness training, identify potential business interruptions, develop safeguards, and implement recovery procedures; provide documentation and training on contingency planning concepts and procedures.
Support assessments of the operational effectiveness of security controls and required remediation.
Assist in executing information security programs, including meeting NIST and PCI DSS compliance requirements.
Assist in developing and updating compliance standards.

Desired Qualifications

IT Audit experience is preferred.
Industry certifications such as CTPRP, CTPRA, CRISC, CISSP, CISA, or a comparable credential in risk management, auditing, privacy, or information security are preferred.
Familiarity with Governance, Risk, and Compliance (GRC) or Integrated Risk Management (IRM) applications.

Salary Range: 102400 to 124800 (Currency: USD) (Pay period: per-year-salary)

Summary

The Risk & Compliance Analyst II - Third-Party Risk Management (TPRM) will lead governance, risk, and compliance initiatives with a strong focus on third-party risk program management, vendor risk and control assessments, and risk treatment using OneTrust Third-Party Risk Management. This role ensures adherence to regulatory requirements, internal policies, and industry standards while driving continuous improvement in Allegiant’s third-party risk posture. The TPRM Analyst II will collaborate across Legal, Information Security, Privacy, IT, Procurement, and business teams to strengthen third-party risk practices and support informed vendor risk decisions.

Visa Sponsorship

Minimum Requirements

Combination of Education and Experience will be considered. Must be authorized to work in the US as defined by the Immigration Act of 1986. Must pass a Criminal Background Check.

Education:Bachelor's degree in a related field.
Years of Experience: Minimum four (4) years of experience in Internal Audit (IT Audit preferred), IT Risk, or Information Security.
Knowledge of project management skills (task identification, prioritization, and documentation).
Demonstrated ability to effectively balance multiple responsibilities which may frequently change.
Ability to learn information quickly and apply risk/control considerations which impact downstream decisions.
Ability to interface effectively with internal and external auditors.
Critical thinking skills with strong attention to detail and follow up.
High degree of professionalism and personal integrity.
Ability to work with a high degree of independence.
Excellent documentation skills (process, control, policy, and risk documentation).
Excellent verbal and written communication skills across all levels of personnel (through executive management and the Board of Directors).
Knowledge of and experience with performing ongoing risk analysis to determine what customer services, supporting business processes, systems, components and applications need to be recovered and within what time frame in order to comply with recovery time objectives.
Familiarity with internet, networking (LAN and WAN), data and voice telecommunications, and cloud computing in order to assist in the preparation of recovery procedures in these areas.
Good knowledge of Industry "Best Practices" such as ISO 27001, PCI-DSS.
Good knowledge of TCP/IP and related protocols.
Familiarity with intrusion detection and prevention techniques.
Ability to conduct research into security issues and products as required.
Familiarity of standard risk management/control frameworks such as COBIT, ISO 27005, COSO, NIST 80030, and ITIL.
Understanding of internal audit and risk-based methodologies.
Sarbanes-Oxley (SOX) experience.
Understanding and experience with NIST and PCI standards.
Strong experience in any of the following areas: IT Audit, IT Risk and/or Information Security.
Demonstrate proficiency in assessing risk and risk management practices.
Possesses knowledge of IT policies, standards and procedures, security frameworks and their development and implementation.

Preferred Requirements

Preferred Industry certifications include CTPRP, CTPRA, CRISC, CISSP, or a comparable credential in risk management, auditing, privacy, or information security.
Familiarity with either GRC (Governance, risk management, and compliance) or IRC (Integrated Risk Management) applications.
Required hands-on experience with OneTrust Third-Party Risk Management, including third-party intake, assessment workflows, questionnaires, issues, remediation tracking, reporting, and ongoing monitoring.
Solid understanding of end-to-end third-party risk management processes, including intake and scoping, inherent risk assessment, due diligence, control assessment, residual risk determination, risk treatment, ongoing monitoring, reassessment, and offboarding.
Demonstrated ability to identify and evaluate third-party risks and controls across information security, privacy, access management, vulnerability management, incident management, business continuity/disaster recovery, regulatory compliance, and data protection.
Experience documenting control gaps, risk findings, compensating controls, residual risk, remediation plans, and formal risk acceptance decisions.
Understanding of risk treatment options, including mitigation, remediation, transfer, avoidance, and acceptance, and the ability to recommend treatment based on risk severity and business context.
Ability to lead multiple concurrent third-party assessments and coordinate deliverables with vendors, business owners, Information Security, Privacy, Legal, Procurement, and other stakeholders.
Strong analytical and critical-thinking skills, with the ability to review vendor evidence and determine whether controls are appropriately designed and implemented.
Excellent documentation skills, including concise and defensible risk narratives, assessment conclusions, issue statements, action plans, and executive-level reporting.
Excellent verbal and written communication skills across technical and nontechnical audiences, including leadership and external vendors.
Ability to work independently, prioritize changing demands, follow up on open issues, and drive risk treatment activities to completion.
Knowledge of relevant frameworks and standards such as NIST, ISO 27001, PCI DSS, SOC 2, COBIT, and applicable privacy requirements.
Experience with IT risk, information security, internal audit, procurement, vendor management, or compliance programs.
Industry certification such as CTPRP, CTPRA, CRISC, CISA, CISSP, or a comparable risk/security credential is preferred.
Sarbanes-Oxley (SOX), PCI-DSS experience.
Understanding and experience with NIST and PCI-DSS.
Strong experience in any of the following areas: IT Audit, IT Risk and/or Information Security.
Demonstrate proficiency in assessing risk and risk management practices.
Possesses knowledge of IT policies, standards and procedures, security frameworks and their development and implementation.

Job Duties

Participate in all areas of IT Governance, Risk and Compliance.
Perform risk assessments for IT including identifying the risks presented by technological and process changes as well as review of supporting processes/ procedures, etc. to ensure the proper controls are in place and risks are appropriately mitigated.
Gather relevant business, regulatory, process, and system information; validate/update process flows, risks, and controls; prepares accurate, complete, clear, and timely analysis and documentation that reflects an ability to identify risks and independently assess the adequacy and effectiveness of IT internal controls, policies, processes and procedures.
Participate in maintaining the risk register and support continuous improvement of IT risk management processes.
IT Risk Consulting: Work with management and team members to assess risks associated with technology solutions and ensures appropriate remediation strategies are employed. Consult with managers and team members to identify and assess current and emerging risks and strategic initiatives.
IT Regulatory Examinations and Internal Audits: Support IT Audits to ensure their success.
Write effective controls and action plans for any deficiencies.
IT Risk Metrics and Reporting: Assist in the development of risk metric and reporting frameworks for IT Risk & Compliance. Deliver these metrics and reports on weekly, monthly and quarterly basis.
Manage testing request lists from internal and external auditors, providing the interface between IT management and the auditors.
Define action plans and timelines with process owners and manage them to completion/implementation.
Assist with Information Security Incident Management: Investigate, document and report on incidents that impact confidentiality, integrity and/or availability.
Support the administration of IT policies, standards and procedures. Ensures IT Policies, Standards and Procedures meet the guidelines established for each; ensures they are properly housed, refreshed, inventoried and approved.
Draft Information Security deliverables to both internal and external partners on a variety of topics including, security breaches, policy governance, etc.
Conduct scheduled assessment to identify gaps in IT business continuity, emergency and disaster recovery plans.
Maintain and update plans and practices to achieve efficient and effective communication and restoration of operations during IT emergencies.
Coordinate the IT disaster recovery team in scheduling Disaster Recovery (DR) and failover tests to ensure critical applications are tested based on recovery standards.
Participate in IT business continuity planning awareness training and identify potential business interruptions, develop safeguards against these interruptions, and implement recovery procedures in the event of a business interruption. Provide documentation and training on contingency planning concepts and procedures.
Support the completion of assessments of the operational effectiveness of the security controls and supports any required remediation.
Assist in the execution of information security programs, including meeting NIST, PCI-DSS compliance requirements,
Assist in the development and updates of compliance standards.
Other Duties as Necessary.

Physical Requirements

The Physical Demands and Work Environment described here are a representative of those that must be met by a Team Member to successfully perform the essential functions of the role. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions of the role.

Office/IT - While performing the duties of this job, the Team Member is regularly required to stand, sit, talk, hear, see, reach, stoop, kneel, and use hands and fingers to operate a computer, key board, printer, and phone. May be required to lift, push, pull, or carry up to 50 lbs. May be required to work various shifts/days in a 24 hour situation. Regular attendance is a requirement of the role. Exposure to moderate noise (i.e. business office with computers, phones, printers, and foot traffic), temperature and light fluctuations. Ability to work in a confined area as well as the ability to sit at a computer terminal for an extended period of time. Some travel may be a requirement of the role.

Essential Services Provider

Allegiant as a national air carrier is deemed an essential service provider during declared national and state emergencies. Team Members will be required to report to their assigned trip or work location during national and state emergencies unless prohibited by local, state or federal order.

EEO Statement

Equal Opportunity Employer: Disability/Veteran For more information, see https://allegiantair.jobs

People of color, women, LGBTQIA+, immigrants, veterans and persons with disabilities are encouraged to apply.

Full Time Benefits:

Profit Sharing

Medical/Dental/Vision/Life/ Disability Insurance

Medical Travel Reimbursement

Legal, Identity and Pet Insurance

401K with an employer match

Employee Stock Purchase Plan

Employee Assistance Program

Flight Benefits

Paid vacation, holidays, and sick time

Part Time Benefits:

Profit Sharing

Medical Travel Reimbursement

Legal, Identity and Pet Insurance

401K with an employer match

Employee Stock Purchase Plan

Employee Assistance Program

Flight Benefits

Sick time

About the Company

Allegiant Air

Low-cost, all-jet leisure travel carrier

Allegiant Air is a low-cost, all-jet airline based in Las Vegas that serves leisure travelers by offering affordable air travel from smaller cities to vacation destinations. Tickets and bundled travel products such as hotel rooms, rental cars, and entertainment tickets are sold exclusively through Allegiant.com, with revenue coming from ticket sales and the bundles. The company differentiates itself by targeting travelers from smaller markets, using an online-only model, an all-jet fleet, and vacation-package offerings. Its goal is to provide affordable, convenient travel options by expanding its fleet and network and selling bundled experiences online.

Company size: 1,001-5,000
Company stage: IPO
Headquarters: Las Vegas, NV
Founded: 1999

Recently Posted Jobs

Explore more opportunities at Allegiant Air

See more jobs