Compliance Analyst

National Association of Insurance Commissioners (NAIC)•Kansas City, MO

4d•$81,000 - $100,000•Hybrid

About The Position

The Information Technology division of the National Association of Insurance Commissioners (NAIC) is hiring a Compliance Analyst to design, govern, and maintain the organization's security and compliance control framework. The role supports regulatory, contractual, and assurance frameworks, including SOC 2, GovRAMP, PCI DSS, and NIST SP 800-53. Its primary focus is ensuring controls are clearly defined, consistently implemented, effectively monitored, and aligned with organizational risk. The analyst partners with Security, IT, Legal, Internal Audit, and business stakeholders to strengthen governance, reduce audit findings, support regulatory readiness, and continuously improve enterprise cybersecurity and compliance programs. This is a full-time hybrid position in a positive and flexible environment. Candidates must reside within 100 miles of the Kansas City office. Overnight business travel is not required. Employees are responsible for their personal transportation to and from home and the office, including for required events, meetings, and training. Applicants must be authorized to work for any employer in the United States; the NAIC cannot sponsor or take over sponsorship of an employment visa.

Requirements

Bachelor’s degree and 5–7 years of experience in governance, risk, compliance, or information security, or an equivalent combination of education and experience.
Experience with SOC 2, NIST SP 800-53, GovRAMP, or similar frameworks.
Familiarity with vendor risk assessments and policy management.
Residency within 100 miles of the Kansas City office.
Authorization to work for any employer in the United States.

Nice To Haves

Relevant certifications such as CISA, CRISC, or CISSP.

Responsibilities

Conduct third-party risk management activities, including security risk assessments for new vendors, periodic reassessments of existing vendors, reviews of security and privacy contract language, and oversight of vendor remediation.
Develop, maintain, and oversee security policies, standards, procedures, and supporting documentation, ensuring alignment with business requirements, industry best practices, and applicable frameworks including SOC 2, NIST SP 800-53, GovRAMP, and PCI DSS.
Coordinate the annual review, update, approval, and publication of security policies, standards, and compliance documentation.
Support governance, risk, and compliance initiatives by developing, documenting, and monitoring security controls that support compliance obligations and organizational risk management objectives.
Coordinate Business Continuity Planning and Disaster Recovery activities, including maintaining documentation, conducting testing exercises, recording lessons learned, and ensuring plans are reviewed and updated at least annually.
Support security awareness and training programs, including annual content updates, completion tracking, metrics reporting, and audit evidence collection.