Compliance Analyst

NAIC; Kansas City (MO); Hybrid; USD 81,000 - 100,000; Full time

Job summary

The National Association of Insurance Commissioners (NAIC) is seeking a Compliance Analyst to design and govern its security and compliance control framework. This role supports SOC 2, GovRAMP, PCI DSS, and NIST SP 800-53, collaborates with Security, IT, Legal, and Internal Audit, and drives continuous improvement across cyber and compliance programs.

This full-time hybrid position requires residency within 100 miles of the Kansas City office and offers a dynamic work environment with a strong

Qualifications

• Bachelor's degree and 5-7 years of experience in governance, risk, compliance, or information security or an equivalent combination of education and experience.
• Experience with SOC 2, NIST SP 800-53, GovRAMP, or similar frameworks.
• Familiarity with vendor risk assessments and policy management.

Responsibilities

• Conduct Third-Party Risk Management (TPRM) activities, including security risk assessments for new vendors, periodic reassessments of existing vendors, reviews of security and privacy contract language, and oversight of vendor remediation activities.
• Develop, maintain, and oversee security policies, standards, procedures, and supporting documentation, ensuring alignment with business requirements, industry best practices, and applicable frameworks including SOC 2, NIST SP 800-53, GovRAMP, and PCI DSS.
• Coordinate the annual review, update, approval, and publication of security policies, standards, and compliance documentation.
• Support governance, risk, and compliance (GRC) initiatives by developing, documenting, and monitoring security controls that support compliance obligations and organizational risk management objectives.
• Coordinate Business Continuity Planning (BCP) and Disaster Recovery (DR) activities, including documentation maintenance, testing exercises, lessons learned, and ensuring plans are reviewed and updated at least annually.
• Support security awareness and training programs, including annual training content updates, completion tracking, metrics reporting, and audit evidence collection.

Skills

Governance

Risk management

Compliance

Information security

SOC 2

NIST SP 800-53

GovRAMP

Policy management

Vendor risk assessments

Education

Bachelor's degree

Tools

Microsoft Office 365

AWS

Jira Cloud

GRC platforms

Job description

Job Description: The Information Technology division of the National Association of Insurance Commissioners (NAIC) has an exciting opportunity for a Compliance Analyst. This position Designs, governs, and maintains NAIC's security and compliance control framework. Supports multiple regulatory, contractual, and assurance frameworks, including SOC 2, GovRAMP, PCI DSS, and NIST SP 800-53, with a primary focus on ensuring controls are clearly defined, consistently implemented, effectively monitored, and aligned with organizational risk. Partners closely with Security, IT, Legal, Internal Audit, and business stakeholders to strengthen governance, reduce audit findings, support regulatory readiness, and drive continuous improvement across the enterprise's cybersecurity and compliance programs. This is a full-time hybrid position, in a positive and flexible environment. Residency within 100 miles of the Kansas City office is required.

Responsibilities

• Conduct Third-Party Risk Management (TPRM) activities, including security risk assessments for new vendors, periodic reassessments of existing vendors, reviews of security and privacy contract language, and oversight of vendor remediation activities.
• Develop, maintain, and oversee security policies, standards, procedures, and supporting documentation, ensuring alignment with business requirements, industry best practices, and applicable frameworks including SOC 2, NIST SP 800-53, GovRAMP, and PCI DSS.
• Coordinate the annual review, update, approval, and publication of security policies, standards, and compliance documentation.
• Support governance, risk, and compliance (GRC) initiatives by developing, documenting, and monitoring security controls that support compliance obligations and organizational risk management objectives.
• Coordinate Business Continuity Planning (BCP) and Disaster Recovery (DR) activities, including documentation maintenance, testing exercises, lessons learned, and ensuring plans are reviewed and updated at least annually.
• Support security awareness and training programs, including annual training content updates, completion tracking, metrics reporting, and audit evidence collection.

Minimum Education and/or Experience Required

• Bachelor's degree and 5-7 years of experience in governance, risk, compliance, or information security or an equivalent combination of education and experience.
• Experience with SOC 2, NIST SP 800-53, GovRAMP, or similar frameworks.
• Familiarity with vendor risk assessments and policy management.

Preferred Experience

Relevant certifications (CISA, CRISC, CISSP) are a plus.

Systems & Technology Requirements

Microsoft Office Suite/365, AWS, Jira Cloud, GRC platforms

Travel

This position does not require overnight business travel. Employees are responsible for their personal transportation to/from the home and office, including events, meetings, and training required by the NAIC.

Benefits

• Compensation: $81,000- $100,000 commensurate with education and experience.

Sponsorship: Applicants must be authorized to work for any employer in the U.S. We are unable to sponsor or take over sponsorship of an employment Visa at this time.

Interested in learning more about the amazing benefits the NAIC offers? Visit our Benefits page for more information.

The NAIC is proud to be an Equal Opportunity Employer Applicants for all positions are considered without regard to age, race, creed, color, religion, sex, sexual orientation, gender identity or expression, national origin or ancestry, marital status, pregnancy, genetic information, military or veteran status, disability, or any other basis protected by applicable law.

Company Overview

The National Association of Insurance Commissioners (NAIC) is a member-focused, non-profit Association supporting state insurance commissioners, and their departments, to effectively regulate the insurance industry and protect consumers. Headquartered in Kansas City, New York, and Washington DC, our 150-year-old Association offers the coordination of expertise in policy and regulation among state departments, data and technology, financial regulatory support, training and education, and resources for ongoing collaboration among the states and jurisdictions.

Diversity Statement

Our member-driven Association supports the dynamic and diverse needs of state regulatory agencies and the consumers of insurance products and services. Through our ongoing commitment to Diversity, Equity, and Inclusion, we believe our employees provide a wide range of experience and expertise to generate better ideas and solve complex problems consumers and our members face as insurance products and regulations evolve over time.

Guiding Principles

• We put customers first
• We are committed to continuous improvement
• We succeed by working together
• We do what it takes to get the job done
• We communicate often
• We treat colleagues with respect and honesty