Governance, Risk and Compliance Analyst III (GRC Analyst III)

Milliman•New York, NY

2d•$95,574 - $181,228•Remote

About The Position

The Governance, Risk & Compliance Analyst III is a senior-level role on Milliman’s Global Corporate Services Information Security team. The position supports Milliman Practices and the broader firm by managing GRC activities, internal security reviews, contract and questionnaire reviews, audit coordination, vendor risk management, security awareness reporting, automation, AI agent creation, and continuous compliance monitoring. The role validates compliance with the Milliman Information Security Policy, identifies risks and control gaps, and provides consultative guidance to improve the firm’s security posture. It also develops dashboards, workflows, and automated reporting to streamline GRC operations. This is a remote role. Occasional travel is expected, and applicants must be legally authorized to work in the United States without current or future immigration support or sponsorship from Milliman.

Requirements

6–10 years of experience in information security, risk management, audit, compliance, GRC, or related IT roles.
Hands-on security audit or assessment experience, preferably with a consultancy, professional services, finance, insurance, or similar organization.
Experience with the ISO/IEC 27000 series, NIST Cybersecurity Framework, HITRUST CSF, HIPAA, SOC 2, and related security and control frameworks.
Experience with security tools and technologies such as SIEM, VPN, TCP/IP, vulnerability scanning tools such as Qualys, Active Directory, proxy, firewall, IDS/IPS, routers/switches, and open-source information collection.
Experience developing dashboards, metrics, KRIs/KPIs, executive reports, and remediation tracking.
Advanced proficiency with Microsoft Word, Excel, OneNote, PowerPoint, and similar productivity tools.
Strong understanding of security principles, audit practices, policies, guidelines, compliance, and risk management.
Strong technical knowledge of enterprise systems and security areas, including networking, operating systems, identity and access management, secure SDLC, and cloud technologies such as Azure or AWS.
Ability to interpret security data, identify compliance issues, and translate complex technical topics into clear business language.
Excellent project management skills, including the ability to prioritize and manage complex work independently.
Strong communication, presentation, problem-solving, and stakeholder management skills.
Ability to lead, influence, and collaborate with information security teams, technical partners, business leaders, Legal, Compliance, auditors, and senior management.
Ability to work effectively in a globally distributed organization and understand international information security regulations.
Willingness to travel occasionally.
Must be legally authorized to work in the United States without the need for current or future immigration support or sponsorship from Milliman.

Nice To Haves

Bachelor’s or Master’s degree in Computer Science, Engineering, Information Security, or a related field.
CISSP, CISA, CRISC, or equivalent certification.
Experience with automation, workflow creation, AI-enabled tools, or GRC/reporting platforms.

Responsibilities

Serve as a key point of contact for information security contract terms, information security questionnaires, RFPs/RFQs, MSAs, BAAs, addenda, and related inquiries.
Review legal agreements and client documentation for consistency with the Milliman Information Security Policy and applicable privacy and security requirements.
Collaborate with Legal, Compliance, Information Security, and business teams.
Track contract and inquiry status to ensure internal service-level agreements are met.
Maintain approved response libraries, templates, and workflow routing for recurring inquiries.
Create, maintain, and enhance GRC dashboards covering internal reviews, audit readiness, training compliance, vendor risk, KRIs/KPIs, remediation, and control effectiveness.
Develop recurring compliance reports for leadership, risk committees, auditors, and Board-level reporting.
Support continuous compliance monitoring through automated evidence collection, exception tracking, alerts, and escalation workflows.
Monitor policy compliance, control gaps, overdue remediation, and risk trends.
Support compliance enforcement through reporting, follow-up, escalation, and remediation tracking.
Design, create, and maintain AI agents and automations for GRC activities such as questionnaire responses, contract review triage, control mapping, audit evidence collection, vendor intake, compliance reminders, and status reporting.
Streamline GRC workflows for intake, review, approval, evidence collection, escalation, remediation, and reporting.
Validate AI-generated and automated outputs for accuracy, consistency, and compliance with approved guidance.
Document automated workflows, control points, exceptions, and maintenance requirements.
Coordinate responses to external information security audits, SOC 2-related requests, technology and security assessments, and ad hoc third-party auditor inquiries.
Support audit requests for Corporate IT shared services and remote Milliman offices.
Maintain secure audit repositories and ensure timely evidence delivery and closure.
Coordinate responses across Practices when common clients or shared audit requirements arise.
Support the Vendor Risk Management program, including vendor identification, risk assessments, documentation review, and reporting.
Maintain visibility into critical vendors and monitor key risk indicators.
Escalate vendor risks, control gaps, or changes in exposure to appropriate stakeholders or risk committees.
Automate vendor intake, reassessment reminders, evidence collection, risk scoring, and reporting where feasible.
Administer and report on information security awareness training compliance for employees and contractors.
Maintain training metrics, dashboards, reminders, escalations, and evidence of completion.
Identify training trends, overdue training, and opportunities for targeted awareness improvement.

Benefits

Medical, dental, and vision coverage for employees, dependents, and domestic partners.
Employee Assistance Program (EAP) offering confidential support for personal and work-related challenges.
401(k) plan with company matching and profit-sharing contributions.
Discretionary bonus program.
Flexible Spending Accounts (FSA) for dependent care, transportation, and eligible medical expenses.
Paid time off accruing from the first day of work; full-time employees accrue 15 days per year, and employees working less than full-time accrue PTO on a prorated basis.
At least 10 paid holidays per year.
Family building benefits, including adoption and fertility assistance.
11 weeks of paid parental leave for eligible employees.
Life insurance and AD&D, with premiums fully covered by Milliman.
Short-term and long-term disability, fully paid by Milliman.