IT Compliance Analyst

Nexcess

1d•$42,000 - $45,000•Remote

About The Position

The IT Compliance Analyst supports the organization’s security and compliance program through audit coordination, technical evidence review, control testing support, and remediation tracking. The role works with technical and business teams to demonstrate that controls operate effectively, maintain reliable compliance records, and identify gaps before they become audit findings. The analyst evaluates whether evidence demonstrates the relevant control rather than simply collecting and organizing submissions. The role coordinates assigned activities for applicable SOC 1, SOC 2, SOC 3, HIPAA, GDPR, and PCI DSS audits and assessments, from preparation through evidence submission and finding closure. It reviews technical evidence, supports control testing, tracks findings and remediation, maintains compliance documentation, and recommends improvements to evidence quality and audit coordination. The analyst collaborates with auditors, control owners, and technical teams and is expected to demonstrate the company’s Impact Behaviors: Design, Ownership, First Team, and Performance. The role may also perform other duties, responsibilities, and special projects as assigned. The position can be performed in a traditional climate-controlled office or from home. It involves extended periods at a desk and computer screen and a highly stressful environment with varied challenges, deadlines, and a diverse employee population. Reasonable accommodations may be made for individuals with disabilities.

Requirements

Working knowledge of one or more relevant compliance frameworks or requirements, such as SOC, HIPAA, GDPR, or PCI DSS.
Ability to interpret control requirements and determine what evidence reasonably demonstrates control design and operation.
Foundational understanding of Linux and Windows systems, networking, firewalls, access controls, authentication and MFA, vulnerability management, patching, logging, backups, retention, encryption, change management, incident response, and business continuity.
Ability to interpret technical records and explain what they demonstrate, including the relevance of terms such as syslog, CVE, subnet, TLS, root, ACL, and service account.
Ability to manage substantial evidence sets, simultaneous auditor requests, and recurring compliance deadlines.
Comfort working with ticketing systems, documentation platforms, spreadsheets, dashboards, and security or compliance tools.
Strong written communication, documentation, organization, and follow-through.
Sound judgment, attention to detail, curiosity, and professional persistence when resolving incomplete or unclear submissions.

Nice To Haves

Familiarity with multiple relevant compliance frameworks.
Experience supporting audits or assessments in a technology or infrastructure environment.
Experience improving evidence guidance, control documentation, or remediation tracking practices.

Responsibilities

Coordinate assigned audit and assessment activities for SOC 1, SOC 2, SOC 3, HIPAA, GDPR, and PCI DSS, as applicable, from preparation through evidence submission and finding closure.
Serve as a day-to-day contact for auditor requests and follow-up questions, escalating interpretation, policy, and risk decisions to appropriate owners.
Manage evidence trackers, control mappings, recurring compliance activities, and audit deadlines.
Coordinate evidence requests across technical and business functions, clearly communicating requirements, ownership, and timelines.
Gather, review, organize, and validate evidence for relevance, completeness, accuracy, and alignment with the control and review period.
Evaluate technical evidence, including vulnerability scans, logging reports, access records, configuration data, change records, tickets, and system reports.
Assist with control testing by distinguishing documented requirements, control design, and evidence that a control operated effectively.
Identify evidence that does not adequately demonstrate a control and work with control owners to resolve gaps or obtain clarification.
Translate compliance requirements into actionable evidence requests while engaging technical owners for engineering decisions and implementation.
Track findings, exceptions, remediation actions, accountable owners, and deadlines through documented closure.
Review remediation evidence for completeness and alignment with the identified issue, escalating unresolved questions to appropriate reviewers.
Identify missed recurring activities, outdated evidence, documentation gaps, and approaching deadlines.
Follow up with stakeholders and escalate delays or unresolved gaps that could affect audit readiness.
Maintain policies, procedures, control narratives, diagrams, evidence guides, and supporting audit documentation in collaboration with responsible owners.
Maintain traceable records of requests, responses, exceptions, remediation activity, and approvals.
Keep compliance records organized, current, and accessible to authorized stakeholders.
Recommend improvements to evidence quality, documentation consistency, and audit coordination practices.
Demonstrate and promote the company's Impact Behaviors—Design, Ownership, First Team, and Performance—in interactions and decision-making.
Maintain a professional, collaborative, and client-focused approach while supporting team and organizational objectives.
Perform other duties, responsibilities, and special projects as assigned to meet business needs.