Governance, Risk and Compliance Analyst III (GRC Analyst III)

Milliman•New York, NY

1d•Remote

About The Position

The Governance, Risk & Compliance Analyst III is a senior-level position on Milliman’s Global Corporate Services Information Security team. The role supports Milliman Practices and the broader firm by managing governance, risk, and compliance activities, internal security reviews, contract and questionnaire reviews, audit coordination, vendor risk management, security awareness reporting, automation, AI agent creation, and continuous compliance monitoring. The analyst validates compliance with Milliman’s Information Security Policy, identifies risks and control gaps, provides consultative guidance to improve security posture, and develops dashboards, workflows, and automated reporting to streamline GRC operations. This is a remote role. Candidates must be legally authorized to work in the United States without current or future immigration support or sponsorship from Milliman. Occasional travel is required. The expected application deadline is October 29, 2026.

Requirements

6–10 years of experience in information security, risk management, audit, compliance, GRC, or related IT roles.
Hands-on security audit or assessment experience; consultancy, professional services, finance, insurance, or similar organization experience is preferred.
Experience with the ISO/IEC 27000 series, NIST Cybersecurity Framework, HITRUST CSF, HIPAA, SOC 2, and related security or control frameworks.
Experience with security technologies such as SIEM, VPN, TCP/IP, vulnerability scanning tools such as Qualys, Active Directory, proxies, firewalls, IDS/IPS, routers/switches, and open-source information collection.
Experience developing dashboards, metrics, KRIs/KPIs, executive reports, and remediation tracking.
Advanced proficiency with Microsoft Word, Excel, OneNote, PowerPoint, and similar productivity tools.
Strong understanding of security principles, audit practices, policies, guidelines, compliance, and risk management.
Technical knowledge of enterprise systems and security, including networking, operating systems, identity and access management, secure SDLC, and cloud technologies such as Azure or AWS.
Ability to interpret security data, identify compliance issues, and explain complex technical topics in clear business language.
Excellent project management skills, including the ability to prioritize and independently manage complex work.
Strong communication, presentation, problem-solving, and stakeholder management skills.
Ability to lead, influence, and collaborate with information security teams, technical partners, business leaders, Legal, Compliance, auditors, and senior management.
Ability to work effectively in a globally distributed organization and understand international information security regulations.
Willingness to travel occasionally.
Legally authorized to work in the United States without the need for immigration support or sponsorship from Milliman, now or in the future.

Nice To Haves

Bachelor’s or Master’s degree in Computer Science, Engineering, Information Security, or a related field.
CISSP, CISA, CRISC, or equivalent certification.
Experience with automation, workflow creation, AI-enabled tools, or GRC/reporting platforms.
Security audit or assessment experience in a consultancy, professional services, finance, insurance, or similar organization.

Responsibilities

Serve as a key point of contact for information security contract terms, questionnaires, RFPs/RFQs, MSAs, BAAs, addenda, and related inquiries.
Review legal agreements and client documentation for consistency with Milliman’s Information Security Policy and applicable privacy and security requirements.
Collaborate with Legal, Compliance, Information Security, and business teams; track contracts and inquiries to meet internal service-level agreements.
Maintain approved response libraries, templates, and workflow routing for recurring inquiries.
Create and enhance GRC dashboards for internal reviews, audit readiness, training compliance, vendor risk, KRIs/KPIs, remediation, and control effectiveness.
Develop recurring compliance reports for leadership, risk committees, auditors, and Board-level reporting.
Support continuous compliance monitoring through automated evidence collection, exception tracking, alerts, and escalation workflows.
Monitor policy compliance, control gaps, overdue remediation, and risk trends; support enforcement through reporting, follow-up, escalation, and remediation tracking.
Design and maintain AI agents and automations for GRC activities, including questionnaire responses, contract review triage, control mapping, audit evidence collection, vendor intake, reminders, and status reporting.
Improve GRC workflows for intake, review, approval, evidence collection, escalation, remediation, and reporting; validate automated outputs and document workflows, controls, exceptions, and maintenance needs.
Coordinate responses to external information security audits, SOC 2-related requests, technology and security assessments, and third-party auditor inquiries.
Support audit requests for Corporate IT shared services and remote Milliman offices; maintain secure audit repositories and ensure timely evidence delivery and closure.
Coordinate audit responses across Practices when clients or audit requirements are shared.
Support the Vendor Risk Management program, including vendor identification, assessments, documentation review, and reporting.
Monitor critical vendors and key risk indicators; escalate vendor risks, control gaps, or changes in exposure to appropriate stakeholders or risk committees.
Automate vendor intake, reassessment reminders, evidence collection, risk scoring, and reporting where feasible.
Administer and report on information security awareness training compliance for employees and contractors.
Maintain training metrics, dashboards, reminders, escalations, and completion evidence; identify trends, overdue training, and opportunities for targeted awareness improvement.

Benefits

Medical, dental, and vision coverage for employees, dependents, and domestic partners.
Employee Assistance Program (EAP).
401(k) plan with company matching and profit-sharing contributions.
Discretionary bonus program.
Flexible Spending Accounts for dependent care, transportation, and eligible medical expenses.
Paid time off accrues from the first day of work; full-time employees accrue 15 days per year, while employees working less than full-time accrue PTO on a prorated basis.
At least 10 paid holidays per year.
Family building benefits, including adoption and fertility assistance.
11 weeks of paid parental leave for employees who meet eligibility criteria.
Life insurance and AD&D, with premiums fully covered by Milliman.
Short-term and long-term disability, fully paid by Milliman.