Compliance Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Assist in the daily operations of the organization's SOC 2 program

• Organize the collection, validation, and remediation of evidence across control owners

• Ensure continuous readiness for SOC 2 audits throughout the year

• Identify gaps, exceptions, and deficiencies in controls and facilitate remediation efforts

• Aid in the SOC 2 Type 2 audit fieldwork and respond to auditor inquiries

• Manage and operate Drata, including API integrations and automated evidence sources

• Investigate and resolve issues related to failed automated tests and compliance exceptions

• Where feasible, automate the collection of manual evidence

• Contribute to the development of the ISO 42001 AI Management System and AI governance program

• Keep an updated inventory of AI systems, applications, and use cases

• Coordinate AI risk assessments, control activities, and evidence collection

• Maintain the inventory of SaaS/technology and assist with vendor security and compliance reviews

• Monitor vendor compliance gaps, remediation efforts, and evidence

• Keep the risk register updated and work with risk owners for periodic updates

• Support risk assessments related to information security, technology, third-party services, and AI

• Facilitate quarterly access reviews and monitor their completion and remediation

• Organize documentation for SOC 2 and ISO 42001 assessments

• Coordinate requests from auditors and assessors while maintaining audit trails

• Track findings and ensure corrective actions are completed

• Create monthly compliance and IT dashboards for leadership review

• Highlight impending deadlines, overdue tasks, and risks that require management attention

• Report to the Chief Compliance Officer and collaborate with IT, Security, HR, Legal, and other control owners

⛳️ Requirements

• 2–5 years of experience in compliance, governance, risk management, information security, IT audit, or risk management

• Proficient understanding of SOC 2 and information security controls

• Experience with a continuous compliance/GRC platform such as Drata, Vanta, Secureframe, or comparable

• Proven experience in coordinating evidence collection and remediation across both technical and business teams

• Knowledge of NIST, ISO 27001, or CIS Controls

• Excellent organizational abilities and capacity to manage multiple stakeholders and deadlines

• Strong verbal and written communication skills

• Capability to work independently, identify gaps, and drive issues to resolution

• Applicants must have legal authorization to work in the United States without current or future sponsorship

• Preferred: Experience in supporting ISO 42001 or another AI management system

• Preferred: Experience in AI governance, AI risk assessments, or emerging technology risk

• Preferred: Experience in HIPAA or healthcare compliance

• Preferred: ISO 27001 or other ISO management system experience

• Preferred: Certifications or training in CISA, CISM, CRISC, Security+, ISO 27001, or ISO 42001

🏝️ Benefits

• Medical, vision, and dental insurance

• 401(k) plan with company matching

• Paid time off (PTO)

• Flexible days

• Holiday pay

• Comprehensive benefits package