Risk & Compliance Analyst II – Third-Party Risk Management

Summary The Risk & Compliance Analyst II - Third-Party Risk Management (TPRM) will lead governance, risk, and compliance initiatives with a strong focus on third-party risk program management, vendor risk and control assessments, and risk treatment using OneTrust Third-Party Risk Management. This role ensures adherence to regulatory requirements, internal policies, and industry standards while driving continuous improvement in Allegiant’s third-party risk posture. The TPRM Analyst II will collaborate across Legal, Information Security, Privacy, IT, Procurement, and business teams to strengthen third-party risk practices and support informed vendor risk decisions.    Visa Sponsorship No   Minimum Requirements Combination of Education and Experience will be considered. Must be authorized to work in the US as defined by the Immigration Act of 1986. Must pass a Criminal Background Check. Education:Bachelor's degree in a related field. Years of Experience: Minimum four (4) years of experience in Internal Audit (IT Audit preferred), IT Risk, or Information Security. Knowledge of project management skills (task identification, prioritization, and documentation). Demonstrated ability to effectively balance multiple responsibilities which may frequently change. Ability to learn information quickly and apply risk/control considerations which impact downstream decisions. Ability to interface effectively with internal and external auditors. Critical thinking skills with strong attention to detail and follow up. High degree of professionalism and personal integrity.  Ability to work with a high degree of independence. Excellent documentation skills (process, control, policy, and risk documentation). Excellent verbal and written communication skills across all levels of personnel (through executive management and the Board of Directors). Knowledge of and experience with performing ongoing risk analysis to determine what customer services, supporting business processes, systems, components and applications need to be recovered and within what time frame in order to comply with recovery time objectives. Familiarity with internet, networking (LAN and WAN), data and voice telecommunications, and cloud computing in order to assist in the preparation of recovery procedures in these areas. Good knowledge of Industry "Best Practices" such as ISO 27001, PCI-DSS. Good knowledge of TCP/IP and related protocols. Familiarity with intrusion detection and prevention techniques.