Compliance Analyst — GRC & Security Controls Lead

NAIC; Kansas City (MO); Hybrid; USD 81,000 - 100,000; Full time

Job summary

The National Association of Insurance Commissioners (NAIC) is seeking a Compliance Analyst to design and govern its security and compliance control framework. This role supports SOC 2, GovRAMP, PCI DSS, and NIST SP 800-53, collaborates with Security, IT, Legal, and Internal Audit, and drives continuous improvement across cyber and compliance programs.

This full-time hybrid position requires residency within 100 miles of the Kansas City office and offers a dynamic work environment with a strong

Qualifications

• Bachelor's degree and 5-7 years of experience in governance, risk, compliance, or information security or an equivalent combination of education and experience.
• Experience with SOC 2, NIST SP 800-53, GovRAMP, or similar frameworks.
• Familiarity with vendor risk assessments and policy management.

Responsibilities

• Conduct Third-Party Risk Management (TPRM) activities, including security risk assessments for new vendors, periodic reassessments of existing vendors, reviews of security and privacy contract language, and oversight of vendor remediation activities.
• Develop, maintain, and oversee security policies, standards, procedures, and supporting documentation, ensuring alignment with business requirements, industry best practices, and applicable frameworks including SOC 2, NIST SP 800-53, GovRAMP, and PCI DSS.
• Coordinate the annual review, update, approval, and publication of security policies, standards, and compliance documentation.
• Support governance, risk, and compliance (GRC) initiatives by developing, documenting, and monitoring security controls that support compliance obligations and organizational risk management objectives.
• Coordinate Business Continuity Planning (BCP) and Disaster Recovery (DR) activities, including documentation maintenance, testing exercises, lessons learned, and ensuring plans are reviewed and updated at least annually.
• Support security awareness and training programs, including annual training content updates, completion tracking, metrics reporting, and audit evidence collection.

Skills

Governance

Risk management

Compliance

Information security

SOC 2

NIST SP 800-53

GovRAMP

Policy management

Vendor risk assessments

Education

Bachelor's degree

Tools

Microsoft Office 365

AWS

Jira Cloud

GRC platforms

Job description

The National Association of Insurance Commissioners (NAIC) is seeking a Compliance Analyst to design and govern its security and compliance control framework. This role supports SOC 2, GovRAMP, PCI DSS, and NIST SP 800-53, collaborates with Security, IT, Legal, and Internal Audit, and drives continuous improvement across cyber and compliance programs.

This full-time hybrid position requires residency within 100 miles of the Kansas City office and offers a dynamic work environment with a strong