Risk Analyst Visa Sponsorship Jobs in Florida
Florida's risk analyst job market is anchored by financial services firms in Miami and Tampa, insurance carriers concentrated around Jacksonville and Orlando, and a growing fintech sector. Major employers including Citigroup, Raymond James, and Banco Santander have sponsored risk analyst roles in the state, making Florida one of the more active markets for visa sponsorship in this field.
Find Risk Analyst JobsOverview
Showing 5 of 93+ Risk Analyst Jobs in Florida with Visa Sponsorship
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
Have you applied for this role?
See all 93+ Risk Analyst Jobs in Florida with Visa Sponsorship
Sign up for free to unlock all listings, filter by visa type, and get alerts for new Risk Analyst Jobs in Florida with Visa Sponsorship.
Get Access To All JobsWe are a Firm where people truly believe in what they do and strive to achieve the highest standards of performance and success.
This position is based in the Firm's global operations center in Tampa, FL.
General Description:
We are seeking an IT Enterprise Risk Analyst to join our team. The IT Risk Analyst helps manage the Firm’s GRC and IT risk programs, focusing on information security for client data, attorney work, and privileged communications. Reporting to the IT Enterprise Risk Management Manager, the role maintains policies, assesses risks and controls, coordinates third-party reviews, drafts responses for client guidelines, prepares evidence for cyber insurance, and supports audits. Responsibilities align with ISO/IEC 27001/27002, NIST CSF, CIS Controls, SOC 2, HIPAA, GLBA, GDPR, and state privacy laws (e.g., CCPA/CPRA).
Key Responsibilities and Essential Job Functions:
Policy, Standards and Governance
- Support the development, review, and maintenance of information security and technology risk policies, standards, procedures, and guidance documents.
- Maintain the policy lifecycle process, including stakeholder reviews, approvals, publication, periodic review schedules, and version control.
- Map policies/standards to ISO, NIST, CIS Controls, SOC 2, HIPAA, GLBA, U.S. state privacy laws, and EU requirements, and to applicable client Outside Counsel Guidelines and contractual security addenda; maintain crosswalks and control documentation to support audit readiness.
- Administer policy exception and risk acceptance of workflows, ensuring justification, compensating controls, approvals, and defined expiration/renewal dates.
- Contribute to awareness materials and operational guidance to promote consistent implementation of requirements.
- Help maintain controls supporting ethical walls / information barriers, matter-level access restrictions, and legal hold obligations, under the direction of the Senior Analyst and in partnership with the Office of the General Counsel, Conflicts, and Records & Information Governance.
- Maintain awareness of the Firm’s professional responsibility obligations, including ABA Model Rules 1.1 (technology competence) and 1.6 (confidentiality of information), and apply that awareness to policy implementation and control activities.
Information Security and Technology Risk Management
- Conduct or facilitate risk assessments for applications, infrastructure, cloud services, Firm-critical legal-industry platforms (document management, time and billing, conflicts and new business intake, eDiscovery, and matter management), and key business processes; document risk statements, likelihood/impact, and control effectiveness.
- Maintain and update the risk register, including inherent and residual ratings, treatment plans, owners, milestones, and status updates.
- Partner with control owners to identify remediation actions, track progress, and validate closure with appropriate evidence.
- Support ongoing risk monitoring through key risk indicators (KRIs) and control health metrics, including indicators relevant to the legal sector (e.g., business email compromise and wire-fraud schemes, ransomware targeting law firms, and client-confidential data exposure).
- Draft and contribute to risk reporting and summaries for governance forums under the direction of the IT Enterprise Risk Management Manager, including content packaged for Firm leadership and Firm Management Committee audiences.
- Support incident response activities by gathering control and risk evidence, contributing to post-incident lessons learned, and helping ensure resulting control improvements are tracked in the risk register.
Vendor/Third Party Risk Management (TPRM)
- Perform third party security due diligence based on vendor criticality and risk tiering (including third-industry parties such as co-counsel and local counsel, eDiscovery and document review providers, expert witnesses, court reporters and translators, legal-technology SaaS vendors, and managed-service providers handling client matter data); coordinate security questionnaires and evidence collection.
- Review assurance artifacts such as SOC reports, ISO certificates, penetration test summaries, security whitepapers, and privacy/security attestations.
- Identify gaps, document findings, recommend remediation/compensating controls, and track vendor action plans to closure.
- Partner with Procurement/Legal to ensure contracts include appropriate security and privacy requirements (e.g., breach notification, subcontractor controls, right-to-assess, data processing terms, and data residency as applicable).
- Support periodic vendor reassessments and reassessments triggered by scope changes, incidents, or material updates.
- Draft initial responses to inbound client security questionnaires and Outside Counsel Guideline (OCG) inquiries for Senior Analyst review; help maintain a controlled answer library and partner with the engagement attorney and Loss Prevention on follow-ups.
Audit, Assurance and Compliance (ISO / NIST / CIS / SOC 2 / HIPAA / GLBA / EU)
- Support internal and external audits by coordinating evidence collection, control walkthroughs, and timely responses to audit requests.
- Assist with gap assessments and control testing against ISO 27001/27002, NIST CSF / SP 800-53 / 800-171, CIS Controls, SOC 2 Trust Services Criteria, GLBA Safeguards Rule, and HIPAA requirements.
- Support EU-aligned compliance activities where applicable (e.g., GDPR security measures and accountability documentation; NIS2-aligned operational practices).
- Track audit findings, corrective action plans (CAPs), and management responses; monitor remediation progress and validate closure evidence.
- Maintain audit artifacts including control matrices, evidence inventories, and standardized templates to improve repeatability and audit readiness.
- Support control activities related to handling Controlled Unclassified Information (CUI) and other regulated client data for the Firm’s federal, defense, aerospace, and government-contracts practices, including evidence gathering and documentation aligned with NIST SP 800-171, CMMC Level 2 readiness, and ITAR/EAR data-handling requirements, under the direction of the Senior Analyst.
- Help compile control attestations and evidence packages for the Firm’s annual cyber insurance application and renewal cycle, supporting responses to underwriter and broker inquiries under senior oversight.
Expected to maintain a regular and predictable work schedule and full attention to and engagement in work activities on behalf of the firm during business hours unless otherwise approved or required by applicable law.
Special projects and duties as assigned.
Required Skills:
- Strong written and verbal communication skills; ability to translate control requirements into clear documentation and actionable guidance.
- Strong organizational skills and attention to detail.
- Ability to manage multiple priorities and deadlines.
- Knowledge or ability to learn Microsoft Office Suite, or Microsoft 365.
Required Qualifications & Education:
- Bachelor’s degree in information security, Information Technology, Risk Management, Business, or equivalent practical experience.
- 3+ years of experience in GRC, information security, technology risk management, compliance, internal audit, or third-party risk management.
- Working knowledge of ISO/IEC 27000 Family concepts, NIST CSF/SP 800-53/800-171, and HIPAA.
- Familiarity with EU information security and privacy requirements (e.g., GDPR security principles); familiarity with NIS2 is a plus where relevant.
- Experience collecting, organizing, and validating control evidence and supporting audits/assessments.
- Certifications - ISACA: CRISC (Certified in Risk and Information Systems Control) and/or CISA (Certified Information Systems Auditor).
Preferred Qualifications & Education:
- Prior exposure to GRC, IT risk, or information security work in a law firm, professional services firm, or other client-confidential environment is preferred.
- Familiarity with legal-industry technology (document management such as iManage or NetDocuments; time and billing such as 3E or Aderant; conflicts and new business intake such as Intapp; eDiscovery platforms such as Relativity) and with the data-sensitivity considerations they raise is a plus.
- Awareness of the ABA Model Rules of Professional Conduct (in particular Rules 1.1 and 1.6) and applicable state bar requirements relating to technology competence and client confidentiality is preferred.
- Familiarity with Controlled Unclassified Information (CUI) handling, NIST SP 800-171, CMMC, and ITAR/EAR data-handling concepts; prior exposure to federal, defense, or government-contracts client matters is a plus.
- Certifications –
- ISACA: COBIT Foundation, CDPSE, or CGEIT as applicable to governance, privacy, and enterprise risk responsibilities ISO/IEC 27001 Internal Auditor, Lead Implementer, or Lead Auditor.
- Cloud and platform risk certifications such as Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900), Azure Security Engineer Associate (AZ-500), or similar.
Physical Requirements:
- Ability to sit or stand for extended periods of time.
- Moderate or advanced keyboard usage.
Benefits: Our goal is to promote a work environment in which individuals have access to the resources they need to be their best both professionally and personally, which includes resources that encourage individuals to focus on their health and well-being.
Below are the benefits we offer: comprehensive medical (PPO and HDHPs), dental and vision plans including coverage for domestic partners; life and AD&D insurance; short and long term disability insurance; tax-advantaged accounts for health care expenses, including FSAs and HSAs; FSAs for dependent care; health advocacy services; behavioral health and counseling resources for all family members; 401(k); profit sharing; backup dependent care; senior care planning support; resources for individuals with development disabilities and their caregivers; and paid holidays and other paid time off, including paid leave for new parents.
Holland & Knight is an Equal Opportunity Employer and does not discriminate on the basis of race, color, religion, sex (including pregnancy, childbirth or related conditions, transgender status, and sexual orientation), national origin, age, disability, genetic information, veteran status or any other factor prohibited by law.
Applicants who are interested in applying for a position and require an accommodation during the process should contact ApplicantAccommodations@hklaw.com.
Personal Information collected from applicants will be used for the purpose of processing the application throughout any recruitment or employment process, as well as inclusion in a personnel file. Categories of data collected may include name, address, phone numbers, email, Social Security Number, and signature. Holland & Knight may collect further information if you consent to a background check. This includes criminal background, employment, and certifications. Please visit Legal Information Portal for Holland & Knight LLP’s privacy policies.
We are a Firm where people truly believe in what they do and strive to achieve the highest standards of performance and success.
This position is based in the Firm's global operations center in Tampa, FL.
General Description:
We are seeking an IT Enterprise Risk Analyst to join our team. The IT Risk Analyst helps manage the Firm’s GRC and IT risk programs, focusing on information security for client data, attorney work, and privileged communications. Reporting to the IT Enterprise Risk Management Manager, the role maintains policies, assesses risks and controls, coordinates third-party reviews, drafts responses for client guidelines, prepares evidence for cyber insurance, and supports audits. Responsibilities align with ISO/IEC 27001/27002, NIST CSF, CIS Controls, SOC 2, HIPAA, GLBA, GDPR, and state privacy laws (e.g., CCPA/CPRA).
Key Responsibilities and Essential Job Functions:
Policy, Standards and Governance
- Support the development, review, and maintenance of information security and technology risk policies, standards, procedures, and guidance documents.
- Maintain the policy lifecycle process, including stakeholder reviews, approvals, publication, periodic review schedules, and version control.
- Map policies/standards to ISO, NIST, CIS Controls, SOC 2, HIPAA, GLBA, U.S. state privacy laws, and EU requirements, and to applicable client Outside Counsel Guidelines and contractual security addenda; maintain crosswalks and control documentation to support audit readiness.
- Administer policy exception and risk acceptance of workflows, ensuring justification, compensating controls, approvals, and defined expiration/renewal dates.
- Contribute to awareness materials and operational guidance to promote consistent implementation of requirements.
- Help maintain controls supporting ethical walls / information barriers, matter-level access restrictions, and legal hold obligations, under the direction of the Senior Analyst and in partnership with the Office of the General Counsel, Conflicts, and Records & Information Governance.
- Maintain awareness of the Firm’s professional responsibility obligations, including ABA Model Rules 1.1 (technology competence) and 1.6 (confidentiality of information), and apply that awareness to policy implementation and control activities.
Information Security and Technology Risk Management
- Conduct or facilitate risk assessments for applications, infrastructure, cloud services, Firm-critical legal-industry platforms (document management, time and billing, conflicts and new business intake, eDiscovery, and matter management), and key business processes; document risk statements, likelihood/impact, and control effectiveness.
- Maintain and update the risk register, including inherent and residual ratings, treatment plans, owners, milestones, and status updates.
- Partner with control owners to identify remediation actions, track progress, and validate closure with appropriate evidence.
- Support ongoing risk monitoring through key risk indicators (KRIs) and control health metrics, including indicators relevant to the legal sector (e.g., business email compromise and wire-fraud schemes, ransomware targeting law firms, and client-confidential data exposure).
- Draft and contribute to risk reporting and summaries for governance forums under the direction of the IT Enterprise Risk Management Manager, including content packaged for Firm leadership and Firm Management Committee audiences.
- Support incident response activities by gathering control and risk evidence, contributing to post-incident lessons learned, and helping ensure resulting control improvements are tracked in the risk register.
Vendor/Third Party Risk Management (TPRM)
- Perform third party security due diligence based on vendor criticality and risk tiering (including third-industry parties such as co-counsel and local counsel, eDiscovery and document review providers, expert witnesses, court reporters and translators, legal-technology SaaS vendors, and managed-service providers handling client matter data); coordinate security questionnaires and evidence collection.
- Review assurance artifacts such as SOC reports, ISO certificates, penetration test summaries, security whitepapers, and privacy/security attestations.
- Identify gaps, document findings, recommend remediation/compensating controls, and track vendor action plans to closure.
- Partner with Procurement/Legal to ensure contracts include appropriate security and privacy requirements (e.g., breach notification, subcontractor controls, right-to-assess, data processing terms, and data residency as applicable).
- Support periodic vendor reassessments and reassessments triggered by scope changes, incidents, or material updates.
- Draft initial responses to inbound client security questionnaires and Outside Counsel Guideline (OCG) inquiries for Senior Analyst review; help maintain a controlled answer library and partner with the engagement attorney and Loss Prevention on follow-ups.
Audit, Assurance and Compliance (ISO / NIST / CIS / SOC 2 / HIPAA / GLBA / EU)
- Support internal and external audits by coordinating evidence collection, control walkthroughs, and timely responses to audit requests.
- Assist with gap assessments and control testing against ISO 27001/27002, NIST CSF / SP 800-53 / 800-171, CIS Controls, SOC 2 Trust Services Criteria, GLBA Safeguards Rule, and HIPAA requirements.
- Support EU-aligned compliance activities where applicable (e.g., GDPR security measures and accountability documentation; NIS2-aligned operational practices).
- Track audit findings, corrective action plans (CAPs), and management responses; monitor remediation progress and validate closure evidence.
- Maintain audit artifacts including control matrices, evidence inventories, and standardized templates to improve repeatability and audit readiness.
- Support control activities related to handling Controlled Unclassified Information (CUI) and other regulated client data for the Firm’s federal, defense, aerospace, and government-contracts practices, including evidence gathering and documentation aligned with NIST SP 800-171, CMMC Level 2 readiness, and ITAR/EAR data-handling requirements, under the direction of the Senior Analyst.
- Help compile control attestations and evidence packages for the Firm’s annual cyber insurance application and renewal cycle, supporting responses to underwriter and broker inquiries under senior oversight.
Expected to maintain a regular and predictable work schedule and full attention to and engagement in work activities on behalf of the firm during business hours unless otherwise approved or required by applicable law.
Special projects and duties as assigned.
Required Skills:
- Strong written and verbal communication skills; ability to translate control requirements into clear documentation and actionable guidance.
- Strong organizational skills and attention to detail.
- Ability to manage multiple priorities and deadlines.
- Knowledge or ability to learn Microsoft Office Suite, or Microsoft 365.
Required Qualifications & Education:
- Bachelor’s degree in information security, Information Technology, Risk Management, Business, or equivalent practical experience.
- 3+ years of experience in GRC, information security, technology risk management, compliance, internal audit, or third-party risk management.
- Working knowledge of ISO/IEC 27000 Family concepts, NIST CSF/SP 800-53/800-171, and HIPAA.
- Familiarity with EU information security and privacy requirements (e.g., GDPR security principles); familiarity with NIS2 is a plus where relevant.
- Experience collecting, organizing, and validating control evidence and supporting audits/assessments.
- Certifications - ISACA: CRISC (Certified in Risk and Information Systems Control) and/or CISA (Certified Information Systems Auditor).
Preferred Qualifications & Education:
- Prior exposure to GRC, IT risk, or information security work in a law firm, professional services firm, or other client-confidential environment is preferred.
- Familiarity with legal-industry technology (document management such as iManage or NetDocuments; time and billing such as 3E or Aderant; conflicts and new business intake such as Intapp; eDiscovery platforms such as Relativity) and with the data-sensitivity considerations they raise is a plus.
- Awareness of the ABA Model Rules of Professional Conduct (in particular Rules 1.1 and 1.6) and applicable state bar requirements relating to technology competence and client confidentiality is preferred.
- Familiarity with Controlled Unclassified Information (CUI) handling, NIST SP 800-171, CMMC, and ITAR/EAR data-handling concepts; prior exposure to federal, defense, or government-contracts client matters is a plus.
- Certifications –
- ISACA: COBIT Foundation, CDPSE, or CGEIT as applicable to governance, privacy, and enterprise risk responsibilities ISO/IEC 27001 Internal Auditor, Lead Implementer, or Lead Auditor.
- Cloud and platform risk certifications such as Microsoft Certified: Security, Compliance, and Identity Fundamentals (SC-900), Azure Security Engineer Associate (AZ-500), or similar.
Physical Requirements:
- Ability to sit or stand for extended periods of time.
- Moderate or advanced keyboard usage.
Benefits: Our goal is to promote a work environment in which individuals have access to the resources they need to be their best both professionally and personally, which includes resources that encourage individuals to focus on their health and well-being.
Below are the benefits we offer: comprehensive medical (PPO and HDHPs), dental and vision plans including coverage for domestic partners; life and AD&D insurance; short and long term disability insurance; tax-advantaged accounts for health care expenses, including FSAs and HSAs; FSAs for dependent care; health advocacy services; behavioral health and counseling resources for all family members; 401(k); profit sharing; backup dependent care; senior care planning support; resources for individuals with development disabilities and their caregivers; and paid holidays and other paid time off, including paid leave for new parents.
Holland & Knight is an Equal Opportunity Employer and does not discriminate on the basis of race, color, religion, sex (including pregnancy, childbirth or related conditions, transgender status, and sexual orientation), national origin, age, disability, genetic information, veteran status or any other factor prohibited by law.
Applicants who are interested in applying for a position and require an accommodation during the process should contact ApplicantAccommodations@hklaw.com.
Personal Information collected from applicants will be used for the purpose of processing the application throughout any recruitment or employment process, as well as inclusion in a personnel file. Categories of data collected may include name, address, phone numbers, email, Social Security Number, and signature. Holland & Knight may collect further information if you consent to a background check. This includes criminal background, employment, and certifications. Please visit Legal Information Portal for Holland & Knight LLP’s privacy policies.
Risk Analyst Job Roles in Florida
See all 93+ Risk Analyst Jobs in Florida
Sign up for free to filter by visa type, set job alerts, and find employers with verified sponsorship history.
Search Risk Analyst Jobs in FloridaRisk Analyst Jobs in Florida: Frequently Asked Questions
Which companies sponsor visas for risk analysts in Florida?
Florida-based financial institutions and insurance firms are among the most active sponsors for risk analyst roles. Companies such as Citigroup and Raymond James have a documented history of H-1B visa sponsorship in Florida. Large regional banks, global insurance carriers headquartered in Jacksonville, and fintech firms expanding in Miami also appear regularly in Department of Labor LCA filings for risk analyst positions.
Which visa types are most common for risk analyst roles in Florida?
The H-1B is the most common visa for risk analysts in Florida, as the role typically qualifies as a specialty occupation requiring at least a bachelor's degree in finance, statistics, economics, or a related field. Candidates with advanced degrees may also pursue the EB-2 or EB-2 National Interest Waiver pathway. Australians may qualify for the E-3 visa, which has no lottery and can be a faster route into Florida risk analyst roles.
Which cities in Florida have the most risk analyst sponsorship jobs?
Miami leads the state for risk analyst sponsorship activity, driven by its concentration of international banks, private equity firms, and Latin American financial operations. Tampa follows closely, anchored by Raymond James and a growing cluster of financial services and insurance employers. Orlando and Jacksonville also generate steady demand, particularly from insurance carriers and regional banks with large back-office operations in both cities.
How to find risk analyst visa sponsorship jobs in Florida?
Migrate Mate filters job listings specifically by visa sponsorship availability, making it practical to search for risk analyst roles in Florida without sorting through positions that don't offer sponsorship. You can narrow results by city, visa type, and employer size. Because Miami, Tampa, and Jacksonville each have distinct employer mixes, browsing by city on Migrate Mate helps identify which specific firms are actively hiring and sponsoring in each market.
Are there state-specific factors that affect risk analyst sponsorship in Florida?
Florida has no state income tax, which affects prevailing wage comparisons since employers filing Labor Condition Applications must meet DOL wage benchmarks rather than adjust for local tax burdens. The state's large international banking sector, particularly in Miami, creates above-average demand for candidates with multilingual skills or familiarity with Latin American financial markets. Several Florida universities, including the University of Florida and Florida International University, supply a pipeline of quantitatively trained graduates that shapes local hiring competition for sponsored roles.
What is the prevailing wage for sponsored risk analyst jobs in Florida?
U.S. employers sponsoring a visa must pay at least the prevailing wage, which is what workers in the same role, area, and experience level typically earn. The Department of Labor sets this rate to make sure companies aren't hiring foreign workers simply because they'd accept lower pay than a U.S. worker. It varies by job title, location, and experience. You can look up current prevailing wage rates for any occupation and location using the OFLC Wage Search page.