Compliance Analyst
Role Overview
The role supports day-to-day operation of the company’s SOC 2 program and will help develop its ISO 42001 AI Management System and AI governance program.
The immediate priority is keeping SOC 2 controls, evidence, and remediation on track throughout the year.
The analyst works with IT, Security, HR, Legal, and other control owners; the Chief Compliance Officer retains program ownership.
Key Skills for This Role
Full Job Posting
Position overview
The role supports day-to-day operation of the company’s SOC 2 program and will help develop its ISO 42001 AI Management System and AI governance program.
The immediate priority is keeping SOC 2 controls, evidence, and remediation on track throughout the year.
The analyst works with IT, Security, HR, Legal, and other control owners; the Chief Compliance Officer retains program ownership.
SOC 2 and continuous compliance
- Coordinate evidence collection, validation, and remediation across control owners; follow up on overdue or incomplete items.
- Maintain year-round audit readiness, identify control gaps and exceptions, and coordinate remediation.
- Support SOC 2 Type 2 audit fieldwork and auditor requests.
- Escalate overdue or material issues to the CCO and relevant IT or business leadership.
Drata administration
- Operate and maintain Drata, including API integrations and automated evidence sources.
- Investigate failed automated tests and compliance exceptions; keep evidence complete, accurate, and correctly mapped to controls.
- Find opportunities to automate manual evidence collection and reduce recurring work.
ISO 42001 and AI governance
- Support the AI Management System with policies, procedures, controls, risk assessments, and supporting documentation.
- Help maintain an inventory of AI systems, applications, and use cases.
- Coordinate AI risk and impact assessments, control activities, and evidence collection.
- Work with IT and business stakeholders to implement AI governance requirements and support future readiness and certification work.
Vendor governance and risk
- Maintain the SaaS and technology inventory and support security and compliance reviews of new and existing vendors.
- Track vendor compliance gaps, remediation, and evidence for SOC 2 and applicable ISO 42001 requirements.
- Maintain the risk register and coordinate periodic updates and information security, technology, third-party, and AI-related risk assessments.
- Facilitate quarterly access reviews and track completion and remediation; escalate material or overdue risks.
Audit readiness and reporting
- Organize assessment documentation, coordinate auditor and assessor requests, and maintain audit trails.
- Track findings and corrective actions through closure.
- Build monthly compliance and IT dashboards covering MFA, access reviews, onboarding and offboarding SLAs, evidence, remediation, vendors, and trends.
- Surface upcoming deadlines, overdue items, and risks needing management attention.
Qualifications
- 2–5 years in compliance, GRC, information security, IT audit, or risk management.
- Working knowledge of SOC 2 and information security controls.
- Experience with a GRC or continuous compliance platform such as Drata, Vanta, Secureframe, or similar.
- Experience coordinating evidence collection and remediation across technical and business teams.
- Familiarity with NIST, ISO 27001, or CIS Controls.
- Strong organizational skills and comfort managing multiple compliance activities.
About Allia Health Group
Allia Health Group is a digital health system with telehealth, pharmacy, and provider-network businesses and a shared technology and AI platform.
The company describes its care as clinician-first, patient-centered, and available across more than 35 states.
Apply for this job in 1 click
Skip the repetitive application forms
Install the Base Career Chrome Extension and autofill job applications across major job boards with your profile.
Trusted by over 500,000 job seekers on Base Career