IT Risk and Compliance Analyst

Role overview A fully remote role within the United States (not currently hiring in New Mexico, Montana, Alaska, or Hawaii) for an IT Risk and Compliance Analyst to drive day-to-day operations of a risk and compliance program that is being rebuilt from the ground up. The position is a generalist role spanning client contracts, security due diligence, control evidence, vendor risk, data retention, and privacy program support.

Responsibilities - Review client agreements (MSAs, SOWs, DPAs, and security exhibits) to surface items that need attention and move contracts through redlines to signature. - Translate signed contractual obligations on security, privacy, data handling, audit rights, breach notice, and sub-processors into tracked commitments and confirm operational delivery. - Respond to client security questionnaires and audit inquiries while maintaining a reusable answer library for faster, more consistent replies. - Collect and organize control evidence in a GRC platform and track gap remediation across SOC 2, ISO 27001, NIST CSF, and similar standards. - Support vendor risk reviews for SaaS and AI providers, including documentation review and ongoing monitoring in a vendor register. - Operate the data retention and disposal policy, document legal hold exceptions, and verify retention settings with IT.

Requirements - Bachelor's degree or equivalent practical experience. - 3–5 years in compliance, GRC, contract management, privacy, or a closely related field. - Hands-on experience reading and reviewing commercial contracts, ideally MSAs, DPAs, or security addenda, and working with counsel on redlines. - Working knowledge of at least one major framework (SOC 2, ISO 27001, NIST CSF) and what evidence looks like in practice. - Foundational understanding of GDPR and CCPA and how those rules show up in contracts. - Strong organization and follow-through, with clear and concise written communication.

Benefits and work setup - Salary range: $80,000–$90,000 USD. - Remote within the United States, excluding NM, MT, AK, and HI.