Compliance Analyst

Position Overview

This role supports the day-to-day operation of the company's SOC 2 program, and over time will help build out our ISO 42001 AI Management System (AIMS) and AI governance program. The immediate priority is keeping SOC 2 controls, evidence, and remediation on track throughout the year, not just ahead of audit season. The analyst will work with IT (including the CTO/CISO and their team), Security, HR, Legal, and other control owners to turn compliance requirements into concrete tasks, keep evidence current, flag gaps early, and keep the organization audit-ready on an ongoing basis. The role reports to the Chief Compliance Officer, who retains ownership of the compliance program. The analyst operationalizes and maintains technology-related controls alongside IT while providing independent compliance oversight.

Key Responsibilities

SOC 2 & continuous compliance

• Coordinate evidence collection, validation, and remediation across control owners; follow up on overdue or incomplete items.
• Maintain audit readiness year-round rather than treating SOC 2 as an annual exercise.
• Identify control gaps, exceptions, and deficiencies, and coordinate remediation with the responsible team.
• Support SOC 2 Type 2 audit fieldwork and auditor requests.
• Escalate overdue or material issues to the CCO and relevant IT/business leadership.

Drata administration

• Operate and maintain Drata day to day, including API integrations and automated evidence sources.
• Investigate and remediate failed automated tests and compliance exceptions.
• Keep evidence complete, accurate, and correctly mapped to controls.
• Look for ways to automate manual evidence collection and cut recurring effort.

ISO 42001 & AI governance

• Support building the AIMS: policies, procedures, controls, risk assessments, and supporting documentation.
• Help build and maintain an inventory of AI systems, applications, and use cases.
• Coordinate AI risk and impact assessments, control activities, and evidence collection.
• Work with IT and business stakeholders to put AI governance requirements into practice.
• Support future ISO 42001 readiness assessments and certification work.

SaaS & vendor governance

• Maintain the SaaS/technology inventory.
• Support security and compliance reviews for new and existing vendors (SOC reports, questionnaires, certifications, contract requirements).
• Track vendor compliance gaps and remediation, and keep related evidence current for SOC 2 and applicable ISO 42001 requirements.

Risk management

• Maintain the risk register and coordinate periodic updates with risk owners.
• Support information security, technology, third-party, and AI-related risk assessments.
• Facilitate quarterly access reviews and track completion and remediation.
• Escalate material or overdue risks to the CCO and appropriate leadership.

Audit readiness

• Organize and maintain documentation for SOC 2 and ISO 42001 assessments.
• Coordinate responses to auditor and assessor requests, and maintain audit trails.
• Track findings and corrective actions through closure.

Reporting

• Build monthly compliance and IT dashboards for leadership: MFA coverage, access review completion, onboarding/offboarding SLAs, evidence completion, remediation status, vendor reviews, and trends.
• Surface upcoming deadlines, overdue items, and risks that need management attention.

Qualifications

• 2–5 years in compliance, GRC, information security, IT audit, or risk management.
• Working knowledge of SOC 2 and information security controls.
• Experience with a GRC/continuous compliance platform (Drata, Vanta, Secureframe, or similar).
• Experience coordinating evidence collection and remediation across technical and business teams.
• Familiarity with NIST, ISO 27001, or CIS Controls.
• Strong organizational skills and comfort managing multiple stakeholders and deadlines.
• Strong written and verbal communication.
• Able to work independently, spot gaps, and drive issues to resolution.

Preferred

• Experience supporting ISO 42001 or another AI management system.
• Experience with AI governance, AI risk assessments, or emerging technology risk.
• HIPAA or healthcare compliance experience, ideally in a technology or regulated environment.
• ISO 27001 or other ISO management-system experience.
• CISA, CISM, CRISC, Security+, ISO 27001, or ISO 42001 certification or training.

What success looks like

Continuous SOC 2 readiness, evidence and remediation completed on time, clear accountability among control owners, and fewer items requiring manual escalation. Over time, a working foundation for ISO 42001 and AI governance: a documented AI inventory, risks, controls, and ongoing monitoring.