IT Risk and Compliance Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Analyze client MSAs, SOWs, DPAs, and security addenda using contract analysis tools; identify clauses that require attention from Legal, IT, or Delivery, and manage the redlining process until signature.

• Convert signed contractual obligations into monitored commitments and ensure operational compliance.

• Address client security questionnaires, due diligence inquiries, and audit requests; maintain a library of reusable responses.

• Gather, organize, and manage control evidence within the GRC platform; track remediation of gaps against SOC 2, ISO 27001, NIST CSF, and other frameworks.

• Assist in vendor risk assessments for SaaS and AI providers; review security documentation, DPAs, and sub-processor lists, and monitor the findings.

• Implement data retention and disposal policies; monitor retention schedules, exceptions, and legal holds, and verify platform settings with IT.

• Aid privacy program initiatives, including data mapping, data subject requests, and tracking obligations under GDPR and CCPA.

• Draft and uphold compliance policies, SOPs, and process documentation.

• Produce risk and compliance status reports for leadership.

• Engage in business continuity, disaster recovery planning, tabletop exercises, and security incident response management.

• Maintain and oversee the risk register and prepare for the annual risk assessment.

• Conduct security awareness training and monitor compliance.

• Assist with internal audits, access reviews, and periodic control testing.

⛳️ Requirements

• A bachelor’s degree is required or equivalent practical experience.

• 3–5 years of experience in compliance, GRC, contract management, privacy, or a similar field.

• Practical experience in reading and reviewing commercial contracts, particularly MSAs, DPAs, or security addenda, and collaborating with legal counsel on redlines.

• Experience in responding to client security questionnaires or vendor due diligence requests.

• Familiarity with at least one major compliance framework (SOC 2, ISO 27001, NIST CSF) and understanding what evidence looks like in practice.

• Foundational knowledge of data privacy regulations (GDPR, CCPA) and their implications in contracts.

• Outstanding organizational skills and the ability to follow through effectively.

• Clear and concise written communication abilities.

• Comfortable using SaaS tools and quick to learn new platforms.

• Self-motivated and effective in a small team environment where you are responsible for outcomes from start to finish.

• This position is not available for hire or work in New Mexico, Montana, Alaska, and Hawaii, USA.

🏝️ Benefits

• An inclusive employee experience.

• Equal opportunity employer.

• An inclusive, barrier-free recruitment and selection process.

• Confidential accommodation support during recruitment.

• Recruitment fees paid by workers will be reimbursed.