Compliance Analyst

The Information Technology division of the National Association of Insurance Commissioners (NAIC) has an exciting opportunity for a Compliance Analyst. This position Designs, governs, and maintains NAIC's security and compliance control framework. Supports multiple regulatory, contractual, and assurance frameworks, including SOC 2, GovRAMP, PCI DSS, and NIST SP 800-53, with a primary focus on ensuring controls are clearly defined, consistently implemented, effectively monitored, and aligned with organizational risk. Partners closely with Security, IT, Legal, Internal Audit, and business stakeholders to strengthen governance, reduce audit findings, support regulatory readiness, and drive continuous improvement across the enterprise's cybersecurity and compliance programs. This is a full-time hybrid position, in a positive and flexible environment. Residency within 100 miles of the Kansas City office is required.

Responsibilities

Conduct Third-Party Risk Management (TPRM) activities, including security risk assessments for new vendors, periodic reassessments of existing vendors, reviews of security and privacy contract language, and oversight of vendor remediation activities; Develop, maintain, and oversee security policies, standards, procedures, and supporting documentation, ensuring alignment with business requirements, industry best practices, and applicable frameworks including SOC 2, NIST SP 800-53, GovRAMP, and PCI DSS; Coordinate the annual review, update, approval, and publication of security policies, standards, and compliance documentation; Support governance, risk, and compliance (GRC) initiatives by developing, documenting, and monitoring security controls that support compliance obligations and organizational risk management objectives; Coordinate Business Continuity Planning (BCP) and Disaster Recovery (DR) activities, including documentation maintenance, testing exercises, lessons learned, and ensuring plans are reviewed and updated at least annually; Support security awareness and training programs, including annual training content updates, completion tracking, metrics reporting, and audit evidence collection

Requirements

Bachelor's degree and 5-7 years of experience in governance, risk, compliance, or information security or an equivalent combination of education and experience; Experience with SOC 2, NIST SP 800-53, GovRAMP, or similar frameworks; Familiarity with vendor risk assessments and policy management

Nice to have

Relevant certifications (CISA, CRISC, CISSP)