Compliance Analyst

AP MAX INC• Remote, US,

20d•$90,000 - $118,000

About The Position

The Compliance Analyst supports the day-to-day operation of Allia Health Group’s SOC 2 program and will help build its ISO 42001 AI Management System (AIMS) and AI governance program over time. The immediate priority is keeping SOC 2 controls, evidence, and remediation on track throughout the year and maintaining continuous audit readiness. The analyst works with IT, including the CTO/CISO and their team, Security, HR, Legal, and other control owners to translate compliance requirements into concrete tasks, keep evidence current, identify gaps early, and coordinate remediation. The role reports to the Chief Compliance Officer, who retains ownership of the compliance program. The analyst operationalizes and maintains technology-related controls alongside IT while providing independent compliance oversight. The role also supports vendor and SaaS governance, risk management, audit readiness, and leadership reporting. Success means timely evidence and remediation, clear accountability among control owners, reduced manual escalation, and a documented foundation for AI governance, including AI inventory, risks, controls, and ongoing monitoring.

Requirements

2–5 years of experience in compliance, GRC, information security, IT audit, or risk management.
Working knowledge of SOC 2 and information security controls.
Experience with a GRC or continuous compliance platform such as Drata, Vanta, Secureframe, or similar.
Experience coordinating evidence collection and remediation across technical and business teams.
Familiarity with NIST, ISO 27001, or CIS Controls.
Strong organizational skills and comfort managing multiple stakeholders and deadlines.
Strong written and verbal communication skills.
Ability to work independently, identify gaps, and drive issues to resolution.
Must be legally authorized to work in the United States without needing current or future employment visa sponsorship.

Nice To Haves

Experience supporting ISO 42001 or another AI management system.
Experience with AI governance, AI risk assessments, or emerging technology risk.
HIPAA or healthcare compliance experience, ideally in a technology or regulated environment.
ISO 27001 or other ISO management-system experience.
CISA, CISM, CRISC, Security+, ISO 27001, or ISO 42001 certification or training.

Responsibilities

Coordinate evidence collection, validation, and remediation across control owners, and follow up on overdue or incomplete items.
Maintain year-round SOC 2 audit readiness.
Identify control gaps, exceptions, and deficiencies, and coordinate remediation with responsible teams.
Support SOC 2 Type 2 audit fieldwork and auditor requests.
Escalate overdue or material issues to the Chief Compliance Officer and relevant IT or business leadership.
Operate and maintain Drata, including API integrations and automated evidence sources.
Investigate and remediate failed automated tests and compliance exceptions.
Keep evidence complete, accurate, and correctly mapped to controls.
Identify ways to automate manual evidence collection and reduce recurring effort.
Support development of the AIMS, including policies, procedures, controls, risk assessments, and supporting documentation.
Help build and maintain an inventory of AI systems, applications, and use cases.
Coordinate AI risk and impact assessments, control activities, and evidence collection.
Work with IT and business stakeholders to implement AI governance requirements.
Support future ISO 42001 readiness assessments and certification work.
Maintain the SaaS and technology inventory.
Support security and compliance reviews for new and existing vendors, including reviews of SOC reports, questionnaires, certifications, and contract requirements.
Track vendor compliance gaps and remediation, and keep related evidence current for SOC 2 and applicable ISO 42001 requirements.
Maintain the risk register and coordinate periodic updates with risk owners.
Support information security, technology, third-party, and AI-related risk assessments.
Facilitate quarterly access reviews and track completion and remediation.
Escalate material or overdue risks to the Chief Compliance Officer and appropriate leadership.
Organize and maintain documentation for SOC 2 and ISO 42001 assessments.
Coordinate responses to auditor and assessor requests and maintain audit trails.
Track audit findings and corrective actions through closure.
Build monthly compliance and IT dashboards for leadership covering MFA coverage, access review completion, onboarding and offboarding SLAs, evidence completion, remediation status, vendor reviews, and trends.
Surface upcoming deadlines, overdue items, and risks requiring management attention.