Sr. IT Compliance Analyst

Job summary

Core activities

• Maintains security documentation and supports security policies, procedures, governance tools, and processes.
• Supports information security policy, standards, and operating procedure maturity.
• Identifies compliance process improvements, efficiency gains, and opportunities for standardized controls.
• Works with IT, security, infrastructure, application, and business teams to improve controls and documentation.

Audit, compliance, and training

• Partners with auditors on Sarbanes-Oxley compliance, segregation of duties reviews, control testing, evidence collection, and remediation of findings.
• Maintains IT policies, standards, procedures, control documentation, and audit evidence repositories.
• Supports alignment with the NIST Cybersecurity Framework and other applicable compliance expectations.
• Administers awareness training, phishing simulations, communications, reporting, and follow-up.
• Creates employee communications and training materials about security policies and compliance requirements.

Vendor risk, projects, and AI governance

• Coordinates vendor security and compliance reviews, documents assessments, tracks remediation, and supports recommendations to reduce third-party risk.
• Collects and reviews vendor responses and documentation, coordinates meetings, and tracks actions to completion.
• Supports project plans and delivery, tracking milestones, deliverables, timelines, budgets, resources, risks, dependencies, and status updates.
• Coordinates cloud security and vendor review meetings and engages subject matter experts in assessments.
• Prepares and presents compliance, risk, training, vendor, project, and control status reports.
• Recommends improvements to compliance controls, documentation, project governance, and risk procedures.
• Supports AI intake reviews, risk assessments, approved use-case documentation, vendor due diligence, and monitoring of responsible AI, privacy, security, and data protection.

Qualifications

• The visible qualification text starts with a bachelor's degree in Information Technology, Information Security, Business, Compliance, or a related field; the source text is truncated mid-qualification.