IT Risk and Compliance Analyst

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an IT Risk and Compliance Analyst based in United States.

This role supports the day-to-day execution of a growing IT risk, compliance, privacy, and governance program. You will work across contracts, security questionnaires, control evidence, vendor risk, data retention, and compliance policies. The position offers the opportunity to help shape a program being rebuilt from the ground up and establish scalable ways of working.

• Review client MSAs, SOWs, DPAs, security addenda, and related agreements using contract analysis tools
• Translate contractual security, privacy, data handling, audit, breach notification, and sub-processor requirements into trackable operational commitments
• Respond to client security questionnaires, due diligence requests, and audit inquiries
• Collect, organize, maintain, and manage control evidence within the GRC platform, tracking remediation activities against frameworks such as SOC 2, ISO 27001, NIST CSF
• Support vendor risk management activities for SaaS and AI providers
• Operationalize data retention and disposal requirements
• Support privacy program activities including data mapping, data subject request processes, and monitoring obligations associated with GDPR, CCPA
• Draft, maintain, publish, and improve compliance policies, standard operating procedures, and process documentation
• Prepare risk and compliance reporting for leadership
• Maintain and monitor the risk register, support annual risk assessments
• Participate in business continuity and disaster recovery planning, tabletop exercises, security incident response, internal audits, access reviews, and periodic control testing
• Administer security awareness training programs

• Bachelor's degree or equivalent practical experience, with 3–5 years of professional experience in compliance, GRC, contract management, privacy, risk, or a related field
• Hands-on experience reviewing commercial agreements, ideally including MSAs, DPAs, security addenda
• Experience responding to client security questionnaires, vendor due diligence requests, audit inquiries
• Working knowledge of at least one major security or compliance framework, such as SOC 2, ISO 27001, or NIST CSF
• Foundational understanding of data privacy regulations such as GDPR and CCPA
• Exceptional organizational and follow-through skills
• Clear, concise, and confident written communication skills
• Strong analytical, problem-solving, and judgment skills
• Comfortable working with SaaS platforms, GRC systems, contract analysis tools
• Self-directed and accountable
• Comfortable working across technical, legal, operational, and business functions

• Salary range of $80,000–$90,000 USD
• Remote working arrangement within the United States
• Opportunity to help build and shape an IT risk and compliance program from the ground up
• Broad exposure to IT risk, compliance, privacy, vendor management, contracts, security operations, and governance
• Collaborative and inclusive work environment