IT Compliance Analyst

Overview

The IT Compliance Analyst supports the enterprise IT compliance program by executing control testing, risk analysis, and compliance monitoring activities across the Global IT environment. This role focuses on operational execution and analysis, working under the guidance of the IT Compliance Lead to ensure IT controls are designed and operating effectively.

The Analyst plays a key role in identifying control gaps, documenting compliance and cybersecurity risks, supporting audits, and validating remediation efforts. While the Analyst contributes to risk assessments and compliance conclusions, this role does not approve risk acceptance or exceptions and escalates such matters to the IT Compliance Lead.

This position operates on a hybrid work model, combining onsite and remote work based on business needs.

Responsibilities

1- IT Compliance Execution & Control Testing

• Execute IT control testing activities across infrastructure, applications, security, and cloud environments.
• Support compliance with SOX, ISO 27002, SOC 2, HIPAA, and CMMC by performing evidence collection and control validation.
• Test controls related to access management (IAM), change management, IT operations, SDLC, and configuration management.
• Perform periodic user access reviews, Segregation of Duties (SoD) analysis, and privileged access assessments.
• Document control design, operating effectiveness, testing results, and supporting evidence in accordance with audit standards.
  
  

2- Risk Identification & Compliance Analysis

• Identify control deficiencies, process gaps, and compliance risks during testing and monitoring activities.
• Document findings, root causes, and preliminary risk impact in a clear and auditable manner.
• Analyze cybersecurity and compliance risks related to cloud services, SaaS applications, integrations, and automation.
• Escalate unresolved issues, control failures, and emerging risks to the IT Compliance Lead.
  
  

3- Exception, AI & Residual Risk Support

• Support documentation and tracking of approved IT security and compliance exceptions.
• Assist in documenting AI enabled systems and automation use cases from a compliance and risk perspective.
• Support assessment of AI usage for data protection, access control, logging, and auditability.
• Maintain exception records, compensating controls, and review schedules.
  
  

4- Reporting, Automation & Continuous Improvement

• Maintain accurate compliance issue logs, remediation trackers, and audit schedules.
• Contribute to compliance dashboards, metrics, and audit deliverables.
• Support automation of compliance activities, including evidence collection, access reviews, and reporting.
• Identify opportunities to improve control efficiency and consistency through automation and standardization.
  
  

5- Collaboration & Stakeholder Support

• Collaborate with IT, Security, GRC, and business teams to obtain evidence and clarify control expectations.
• Support audits by responding to auditor requests and preparing supporting documentation.
• Assist in updating IT policies, standards, and procedures to reflect regulatory and technology changes.
  
  

Technical Skills & Knowledge

• Working knowledge of IT compliance and cybersecurity frameworks, including SOX, ISO 27001, SOC 2, CMMC, HIPAA, and NIST.
• Understanding of cybersecurity principles (confidentiality, integrity, availability) and risk based control design.
• Exposure to Artificial Intelligence (AI) concepts, including AI governance considerations and compliance impacts of AI enabled systems.
• Ability to support assessments of AI and automation for compliance, security, and data protection implications.
• Experience with IAM concepts in on prem and cloud environments (e.g., Active Directory, Azure AD / Entra ID).
• Familiarity with SaaS, cloud platforms, and enterprise applications (e.g., Microsoft 365, Dynamics 365).
• Exposure to Third Party Risk Management (TPRM) processes and evidence requirements.
• Experience using GRC platforms and managing audit evidence.
• Basic scripting or automation experience (e.g., PowerShell) preferred.
  
  

Qualifications

• Bachelor's degree in information systems, Engineering, Computer Science, or a related field preferred.
• 45 years of experience in IT compliance, IT audit, IT risk, cybersecurity, or related roles.
• Strong analytical and documentation skills with attention to detail.
• Effective written and verbal communication skills.
• Ability to work collaboratively in a global, cross functional environment.