IT Risk & Compliance Specialist

NORC at the University of Chicago • Chicago, IL

15h • Hybrid

About The Position

NORC at the University of Chicago is seeking a seasoned IT Risk and Compliance Specialist to join our Information Technology Department within the DSS Security and Compliance team. This critical role will focus primarily on continuous monitoring of security controls, risks, vulnerabilities, and compliance activities, with additional responsibility for supporting and administering compliance activities within ServiceNow GRC/IRM and conducting internal and external compliance assessments and audits. The ideal candidate will bring strong experience in continuous monitoring, governance, risk, and compliance activities within regulated environments, particularly those supporting Government security requirements such as FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, and ISO 27001. Preferably, this position will have a hybrid work schedule of one or two days a week in either our Washington, DC or Chicago, IL office. Remote applicants may also be considered. NORC's Digital Services & Solutions group provides technology services to our staff and clients. Given the critical role technology plays in our day-to-day lives, we are committed to providing professional, high-quality solutions in order to further our collective goal of advancing social science research.

Requirements

• Bachelor’s Degree in Management Information Systems, Computer Science, Business Administration, or a related field. Equivalent experience in IT security, risk, or compliance may be considered.
• Current certification in IT security, risk, or compliance, such as Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or Certified in Risk and Information Systems Control (CRISC).
• Minimum of 6+ years of experience in IT security, continuous monitoring, risk assessment, compliance, or auditing, with significant experience supporting government security frameworks and contractual requirements.
• Demonstrated experience performing continuous monitoring activities, including security control reviews, vulnerability and finding management, remediation tracking, compliance evidence review, risk identification, and reporting.
• Experience performing Security Impact Analyses, risk assessments, and control assessments for information systems and technology changes.
• Hands-on experience working with ServiceNow GRC/IRM or comparable Governance, Risk, and Compliance platforms, including managing controls, risks, issues, findings, evidence, and remediation activities.
• Experience developing or maintaining GRC workflows, dashboards, metrics, reporting, and compliance tracking processes.
• Experience supporting internal and external audits and assessments, including preparing and reviewing System Security Plans (SSPs), Corrective Action Plans (CAPs), POA&Ms, Contingency Plans, and control evidence.
• Strong working knowledge of security and compliance frameworks, including FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, ISO 27001, FISMA, and HITRUST.
• Strong understanding of information security controls across infrastructure layers, including networks, servers, databases, cloud environments, and applications.
• Experience supporting compliance within hybrid and multi-tenant infrastructures and familiarity with privacy requirements such as GDPR, CCPA/CPRA, HIPAA Security Rule, and HIPAA Privacy Rule.
• Qualified applicants must be eligible to work in the U.S. We regret that we are unable to offer visa sponsorship for this position.

Responsibilities

• Perform and support continuous monitoring activities across NORC systems and environments to assess the ongoing effectiveness of security controls and identify changes that may impact system risk or compliance.
• Monitor security and compliance findings, vulnerabilities, control deficiencies, remediation activities, exceptions, and other risk indicators to ensure issues are appropriately documented, assigned, tracked, and resolved.
• Review continuous monitoring outputs from security and IT tools and work with Security Engineers, system owners, and other stakeholders to evaluate findings, determine compliance impact, and coordinate remediation.
• Track and report on Corrective Action Plans (CAPs), Plans of Action and Milestones (POA&Ms), control deficiencies, vulnerabilities, exceptions, and remediation activities, including aging, status, ownership, and closure.
• Perform recurring reviews of security controls and supporting evidence to validate continued compliance with requirements such as FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, ISO 27001, FISMA, HITRUST, and applicable contractual requirements.
• Conduct Security Impact Analyses (SIAs) and risk assessments for system, infrastructure, application, and configuration changes to determine potential impacts to security controls, compliance requirements, and organizational risk.
• Utilize and support ServiceNow GRC/IRM to manage controls, risks, issues, findings, evidence, remediation activities, exceptions, and other compliance-related workflows.
• Maintain accurate and complete GRC records within ServiceNow, ensuring compliance activities, control assessments, findings, risks, and remediation efforts are appropriately documented and traceable.
• Support the development, configuration, and improvement of ServiceNow GRC/IRM workflows, dashboards, reporting, control mappings, and automated compliance processes to improve visibility and efficiency across the compliance program.
• Develop and maintain compliance metrics, dashboards, and reporting that provide visibility into control effectiveness, outstanding findings, remediation progress, risk trends, and overall compliance posture.
• Support internal and external IT compliance audits and assessments, including evidence collection, control validation, documentation review, auditor coordination, and remediation tracking for frameworks such as FedRAMP, CMMC, NIST 800-171, and ISO 27001.
• Develop, review, and maintain key security and compliance documentation, including System Security Plans (SSPs), Corrective Action Plans (CAPs), POA&Ms, Contingency Plans, control implementation documentation, policies, procedures, and supporting evidence.
• Collaborate with Security Engineers, system owners, application teams, and other stakeholders to remediate security and compliance issues and maintain alignment with applicable regulatory and contractual requirements.
• Assist in the development and improvement of policies, procedures, control processes, and automated compliance activities for hybrid and multi-tenant infrastructures.
• Translate regulatory, contractual, and security control requirements into actionable technical and operational steps for IT teams and system owners.
• Foster strong, collaborative relationships with NORC’s research community, IT teams, and other key stakeholders to support a culture of security, risk awareness, and continuous compliance.

Benefits

• Generously subsidized health insurance, effective on the first day of employment
• Dental and vision insurance
• A defined contribution retirement program, along with a separate voluntary 403(b) retirement program
• Group life insurance, long-term and short-term disability insurance
• Benefits that promote work/life balance, including generous paid time off, holidays; paid parental leave, bereavement leave, tuition assistance, and an Employee Assistance Program (EAP).

What This Job Offers

• Job Type: Full-time
• Career Level: Senior