IT Risk & Compliance Analyst

NORC at the University of Chicago • Washington DC, WA

2d

About The Position

NORC at the University of Chicago is seeking an IT Risk & Compliance Analyst to join our DSS Security & Compliance team. This role is primarily responsible for supporting NORC's FedRAMP Continuous Monitoring Program, ensuring the ongoing effectiveness of security controls and maintaining compliance with FedRAMP requirements. Working closely with engineering, cloud operations, infrastructure, development, and business teams, the analyst will help assess security control effectiveness, coordinate compliance activities, collect and validate evidence, track remediation efforts, and support ongoing audit readiness. In addition to FedRAMP, the role supports NORC's enterprise governance, risk, and compliance (GRC) program across NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and customer-specific security requirements. The successful candidate will contribute to the continued maturity of NORC's security compliance program by improving continuous monitoring processes, strengthening governance practices, developing compliance metrics, and identifying opportunities to automate and streamline compliance activities. Citizenship: U.S. Citizenship required due to federal project requirements. DEPARTMENT: Digital Data Services & Solutions (DDS) NORC's Digital Services & Solutions (DSS) organization provides enterprise technology services that enable research, innovation, and client success. The Security & Compliance team partners across the organization to strengthen cybersecurity, reduce organizational risk, and maintain compliance with government, client, and industry security requirements.

Requirements

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent professional experience).
• Minimum of two years of experience supporting cybersecurity, governance, risk, or compliance programs.
• Experience supporting or maintaining a FedRAMP Authorized or FedRAMP Ready cloud environment is strongly preferred.
• Knowledge of FedRAMP Continuous Monitoring requirements, including monthly, quarterly, annual, and significant change activities.
• Experience coordinating evidence collection, security control assessments, vulnerability management, remediation tracking, POA&M management, and compliance reporting.
• Experience monitoring security control effectiveness and partnering with technical teams to resolve compliance findings.
• Experience supporting internal or external assessments and audit activities.
• Familiarity with FedRAMP templates, documentation, assessment processes, and security reporting.
• Familiarity with vulnerability management platforms, cloud security technologies, configuration compliance tools, endpoint security, and security monitoring solutions.
• Strong understanding of cybersecurity governance principles and security compliance frameworks including NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and related industry standards.
• Experience developing, reviewing, or maintaining security documentation including policies, standards, procedures, security plans, control documentation, and compliance evidence.
• Experience supporting governance processes that improve compliance consistency, audit readiness, and operational maturity.
• Experience using Governance, Risk, and Compliance (GRC) platforms such as CSAM, ServiceNow GRC, Archer, or similar solutions.
• Experience supporting internal and external audits and working with customers, assessors, auditors, or Third-Party Assessment Organizations (3PAOs) is preferred.
• Experience conducting or supporting security risk assessments, security impact analyses, and control gap assessments.
• Ability to identify security risks, assess business impact, and recommend practical remediation strategies.
• Experience reviewing vulnerability findings and supporting remediation activities.
• Understanding of enterprise risk management methodologies and cybersecurity risk management principles.
• Strong written and verbal communication skills.
• Ability to communicate technical security concepts to both technical and non-technical audiences.
• Experience collaborating with engineering, infrastructure, cloud operations, software development, business stakeholders, and leadership teams.
• Strong organizational skills with the ability to manage multiple priorities in a fast-paced, highly regulated environment.
• Experience coordinating cross-functional initiatives and driving remediation efforts to completion.
• Familiarity with the Authorization to Operate (ATO) process, NIST Risk Management Framework (RMF), FISMA, and FedRAMP authorization processes.
• Experience assisting with System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), or related authorization documentation.
• Experience supporting annual assessments, ongoing authorization activities, or significant system changes is preferred.

Nice To Haves

• CAP, CGRC, CISSP, CISM, CISA or other cybersecurity certification preferred.

Responsibilities

• Serve as a primary contributor to NORC's FedRAMP Continuous Monitoring Program, coordinating recurring activities required to maintain FedRAMP authorization.
• Coordinate monthly, quarterly, annual, and ongoing FedRAMP Continuous Monitoring activities, including evidence collection, security control assessments, vulnerability management, POA&M management, metrics reporting, and security documentation updates.
• Monitor the effectiveness of administrative, technical, and operational security controls across cloud and enterprise environments.
• Partner with engineering, cloud, infrastructure, and operations teams to validate security controls, resolve compliance findings, and improve overall security posture.
• Track security findings, vulnerabilities, and remediation efforts to ensure compliance with FedRAMP and other applicable security requirements.
• Develop, review, validate, and maintain security documentation, including policies, standards, procedures, System Security Plans (SSPs), control implementation statements, and supporting compliance evidence.
• Support internal and external audits by coordinating evidence requests, responding to assessor questions, and managing remediation activities.
• Assist in developing compliance dashboards, metrics, and executive reporting that measure security posture, control effectiveness, and continuous monitoring performance.
• Support governance and compliance initiatives across NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and customer-specific requirements.
• Identify opportunities to improve compliance processes through automation, standardization, and continuous improvement.
• Provide guidance to technical and business teams regarding security requirements, compliance obligations, and cybersecurity best practices.
• Support Authorization to Operate (ATO) activities, annual assessments, and significant system changes as needed.

Benefits

• Generously subsidized health insurance, effective on the first day of employment
• Dental and vision insurance
• A defined contribution retirement program, along with a separate voluntary 403(b) retirement program
• Group life insurance, long-term and short-term disability insurance
• Benefits that promote work/life balance, including generous paid time off, holidays; paid parental leave, bereavement leave, tuition assistance, and an Employee Assistance Program (EAP).

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: Associate degree