Government and Infrastructure-Service Delivery Center-Enterprise Risk. Associate Analyst/Analyst

The opportunity

From strategy to execution, the Government & Infrastructure (G&I) practice of Ernst & Young LLP provides a full range of consulting and audit services to help our Federal, State, Local and Education clients implement new ideas to help achieve their mission outcomes. We deliver real change and measurable results through our diverse, high-performing teams, quality work at the highest professional standards, operational know-how from across our global organization, and creative and bold ideas that drive innovation. We enable our government clients to achieve their mission of protecting the nation and serving the people; increasing public safety; improving healthcare for our military, veterans and citizens; delivering essential public services; and helping those in need. EY is ready to help our government build a better working world.

The Service Delivery Center (SDC) is made up of high-performing, US-based resources who work closely with our experienced professionals to deliver project-based work and managed services to our government clients. The SDC is a core component of G&I. SDC Risk teams work hand in hand with client-site G&I Risk Consulting teams: consulting teams lead the client relationship and overall engagement, and SDC teams deliver repeatable, high-quality execution to agreed procedures, quality standards and service levels.

This role is part of the SDC Risk team aligned to our Enterprise Risk, Controls & Resilience team. The team carries out the repeatable work behind government organizations' internal controls, OMB Circular A-123, audit-readiness, internal audit, enterprise risk, resilience, third-party risk and compliance programs, including controls monitoring and testing delivered as a managed service: process and control documentation, control testing, documentation (PBC) request and evidence management, deficiency and corrective action plan (CAP) tracking, third-party and vendor risk assessments (due diligence, questionnaire and evidence review, and ongoing monitoring), compliance assessments, resilience and continuity support, and recurring risk and compliance reporting.

In this position, you will contribute to our clients' internal controls, OMB Circular A-123, audit-readiness, enterprise risk and compliance initiatives by carrying out defined engagement tasks and managed-service activities. This is a delivery career path. You will build deep, hands-on expertise and grow toward Senior Analyst and Delivery Manager roles or deeper specialization.

Your key responsibilities

• Carry out assigned engagement tasks to defined procedures, timelines, quality standards and service levels (SLAs and KPIs).
• Help document clients' business and financial processes, risks and controls by collecting information from process owners, supporting walkthroughs, and building process maps and narratives.
• Prepare and track documentation (PBC) requests, and collect, organize and maintain evidence in engagement repositories.
• Test the design and operating effectiveness of controls against established test plans, in accordance with guidance such as OMB Circular A-123 and relevant state internal control and internal audit statutes, and document results to working paper standards.
• Track deficiencies and corrective action plans (CAPs), and compile observations and root cause information under guidance.
• Maintain vendor inventories, risk tiering and assessment trackers; issue and follow up on vendor due diligence questionnaires; and collect and organize vendor evidence such as SOC reports, certifications, policies and insurance documentation.
• Perform first-level review of vendor responses and assurance evidence against established checklists, flag gaps or exceptions, and run exclusion screening (e.g., SAM.gov) and other risk intelligence checks under guidance.
• Track vendor findings, remediation commitments and reassessment due dates, and refresh vendor risk dashboards.
• Support compliance testing and resilience activities, such as business impact analysis data collection, critical process and dependency mapping, and continuity plan updates and testing.
• Maintain risk registers, and build and refresh recurring risk, control and compliance reports and dashboards.
• Draft sections of memos, reports and other deliverables using established templates.
• Research regulatory guidance, current industry standards and trends, and new legislation and requirements.
• Use EY-approved AI and automation tools to improve the speed, accuracy and consistency of repeatable tasks.
• Track your progress and raise risks or issues promptly to your Senior Analyst and engagement leads.
• At the Analyst level: review the work products of Associate Analysts and help onboard new team members.

Skills and attributes for success

• Intellectual curiosity and a strong sense of professional skepticism
• Attention to detail and pride in producing accurate, consistent work the first time
• Effective teaming and collaboration with individuals from a variety of backgrounds and skillsets
• Understanding of internal control concepts and frameworks, such as the GAO Green Book, COSO and OMB Circular A-123, including control testing and risk and control self-assessment
• Ability to quickly grasp complex financial business processes involving multiple stakeholders and information systems
• Knowledge of working paper documentation standards
• Understanding of third-party risk and business continuity concepts, such as vendor risk tiering, due diligence questionnaires, SOC reports, ongoing monitoring, common vendor risk domains (cybersecurity, privacy, financial and operational) and business impact analysis
• Knowledge of how to effectively leverage firm approved AI tools to enhance problem-solving and productivity and the ability to exercise sound judgment around AI-related risks and considerations
• Ability to assess and articulate the evolving risks that AI presents to clients across multiple ris