Compliance Analyst III

Southern Illinois University at Carbondale; Carbondale (IL); On-site; USD 65,000 - 90,000; Full time

Job summary

Southern Illinois University at Carbondale is seeking an experienced Compliance Analyst III to support its IT governance, risk, and compliance program. The role conducts complex assessments, coordinates audits, and provides leadership across compliance domains to ensure alignment with institutional policies and external requirements.

The position requires interpreting regulatory and contractual requirements and communicating risks to technical and non-technical stakeholders while advancing audit

Qualifications

• High school diploma or equivalent.
• Two years (24 months) of related IT compliance, governance, risk analysis, audit coordination, or contract-related review activities.

Responsibilities

• Independently scope, plan, and execute complex IT, data protection, and regulatory compliance assessments.
• Coordinate Internal and External Audit engagements, including documentation and remediation tracking.
• Review IT contracts and vendor terms for security, privacy, and data protection requirements; provide risk assessments and mitigation guidance.
• Advise teams and system owners on compliance requirements throughout the system lifecycle.
• Monitor regulatory, contractual, and institutional changes and summarize impacts for leadership.

Skills

IT governance

risk management

compliance

audit coordination

vendor risk

Job description

Description

This position performs advanced professional work in support of theUniversity’s IT governance, risk, and compliance (IT-GRC) program.The Compliance Analyst III is responsible for independentlyconducting complex compliance assessments, coordinating auditactivities, and providing functional leadership across assignedcompliance domains. The role interprets regulatory, contractual,and institutional requirements and translates them into actionablerisk and compliance activities across systems, services, andthird-party environments. The position collaborates extensively with IT, procurement, legal,privacy, and functional units to ensure compliance requirements areconsistently applied and aligned with institutional governanceprocesses. The incumbent exercises independent judgment withinbroadly defined frameworks and provides guidance to stakeholders tosupport audit readiness, risk management, and compliancematurity.

Example of Duties

• Conducts and Oversees Compliance Assessments: Independentlyscopes, plans, and executes complex IT, data protection, andregulatory compliance assessments; evaluates risks and controlgaps; and documents findings and recommended mitigationstrategies.
• Coordinates Audit Activities: Serves as a primary coordinatorfor Internal and External Audit engagements, including planning,documentation collection, response development, and remediationtracking. Performs Contract and Third-Party Risk Review: Evaluates ITcontracts and vendor documentation for security, privacy, and dataprotection requirements; identifies risks and provides structuredrecommendations to support decision-making.
• Provides Compliance Guidance to Stakeholders: Advises projectteams, system owners, and service managers on compliancerequirements and risk considerations throughout the systemlifecycle.
• Aligns Compliance with Project Governance: Coordinatescompliance activities within established project managementprocesses to ensure required reviews, approvals, and artifacts arecompleted.
• Monitors Regulatory and Policy Changes: Tracks changes inregulatory, contractual, and institutional requirements; summarizesimpacts and assists with implementation planning.
• Prepares Reports and Risk Summaries: Develops compliancereports, audit summaries, and risk documentation to supportleadership awareness and decision-making.
• Escalates High-Risk or Nonstandard Issues: Identifies andescalates policy exceptions, high-risk findings, or complex issuesrequiring leadership review and risk acceptance.

Salary is competitive and commensurate with qualifications andexperience, while also considering internal equity.

Examples of Duties

• Provide functional leadership and coordination of assigned ITgovernance, risk, and compliance domains, including establishingpriorities, sequencing work, and ensuring consistent executionacross stakeholders.
• Conduct and oversee complex IT, data protection, and regulatorycompliance assessments in accordance with institutional policies,contractual obligations, legislative mandates, and applicablestandards.
• Independently determine assessment scope, methodology, and riskprioritization for complex systems, services, and third-partyenvironments; document risks, gaps, and recommended mitigationstrategies.
• Serve as the primary coordinator for Internal Audit and ExternalAudit activities within assigned compliance domains, includingplanning, evidence coordination, response development, andremediation tracking.
• Review and analyze IT contracts and vendor terms for security,privacy, and data protection requirements; prepare structured riskassessments and influence contract risk acceptance decisionsthrough clearly articulated risk positions and mitigationstrategies, in coordination with Procurement and ITleadership.
• Define audit response approach, interpret control requirements,and guide stakeholders in developing complete, accurate, anddefensible responses.
• Monitor changes in regulatory, contractual, and institutionalrequirements; interpret applicability and summarize impacts forleadership and stakeholders.
• Contribute expert analytical input to the review, maintenance,and implementation of IT governance, data classification, andcompliance policies and standards.
• Provide compliance and risk guidance to project teams, systemowners, and service managers to support alignment with governancerequirements throughout the system lifecycle.
• Align compliance activities with established project managementgovernance practices by coordinating with project coordinators andresources to ensure required compliance artifacts, reviews, andapprovals are incorporated into project lifecycles.
• Prepare compliance status reports, risk summaries, and decisionsupport materials for leadership review.
• Identify non standard, high risk, or exception based issues andensure appropriate escalation through established governance andrisk management processes.
• Collaborate with IT, procurement, legal, privacy, and functionalpartners to support consistent, risk aware decision making andcontinuous improvement of compliance practices.

Qualifications

1. High school diploma or equivalent.

2. Any one or any combination totaling two (2) years (24 months)from the following categories:

• 30 semester hours equals one (1) year (12 months)
• Associate's Degree (60 semester hours) equals eighteen months(18 months)
• 90 semester hours equals two (2) years (24 months)
• Bachelor's Degree (120 semester hours) equals three (3) years(36 months)

B. Progressively more responsible professional experience in ITcompliance, governance, risk analysis, audit, audit coordination,third-party assessment, project management, financial and bankingactivities, and/or contract-related review activities.

The following experience is required and can be concurrent with thequalifications listed above and concurrent with one another:

3. One year of demonstrated experience performing complex ITcompliance or risk analysis activities within a large or complexorganizational environment, including environments subject tofinancial, privacy, or regulatory oversight.

4. One year of experience coordinating or leading audit andcompliance activities, including documentation management, evidencecollection, and remediation tracking.

5. Ability to interpret regulatory, contractual, and institutionalrequirements and clearly communicate impacts and risks to technicaland non technical stakeholders.

NOTE: Relevant experience may include work performed withinregulated industries such as banking, financial services,healthcare, higher education, or other environments subject to dataprotection and regulatory compliance requirements.

Supplemental Information

Illinois Residency Requirement: Pursuant to the StateUniversities Civil Service System, out-of-state candidates mustestablish Illinois residency within 180 calendar days of the startdate for this position.

Tips for Completing a Civil Service Application

1. To be eligible for the role, ensure that your applicationincludes a complete and detailed employment history that highlightsyour relevant full-time and part-time work experience, includingstart and end dates of employment.

2. Relevant part-time work experience will count towards thequalifications for this position and will be converted to full-timeequivalence to calculate the total length of experience.

3. Upload all official transcripts to meet the educationalrequirements. If the job description specifies a minimum number ofcollege hours, transcripts are mandatory for the successfulprocessing of your application.

4. Veterans who qualify for preference must provide proof ofeligibility within ten (10) working days of submitting anapplication, unless the same proof has already been submitted in aprevious application. The required proof of eligibility includes,at a minimum, a copy of the veteran's DD214/DD215 form (Departmentof Defense), NGB22 form (National Guard), or Discharge Orders orDD256 Discharge Certificate (Reserves).

5. After the position has closed, your application and supportingmaterials will be reviewed to determine if you meet the minimumqualifications, including any specialty factors associated withthis position. Those who qualify will move forward for CivilService Examination/Testing.

6. Please monitor your e-mail for further information regardingyour application. Emails will be generated [e-mail].

7. For more information on Civil Service classifications, pleasevisit the SUCSS web site at sucss.illinois.gov

About Civil Service Examination/Testing

The Civil Serviceexamination for this classification is based on your applicationmaterials and responses to the supplemental questions. Noparticipation other than submission of application materials isrequired from applicants that qualify to take the exam. If you meetthe minimum required qualifications for this position, yourapplication will move forward for examination/testing in which youwill receive a score calculated based on your education andexperience, and your name will be placed on the active employmentregister by exam score. This score will be emailed to the emailaddress noted on your application. After the application deadline,the names within the top three scores will be referred to thedepartment for interview.

This position is not eligible for employer-sponsored workauthorization. Applicants must be legally authorized to work in theUnited States without the need for current or future universitysponsorship to be considered for this role.

Sponsorship for Work Authorization is not available. For moreinformation visit https://policies.siu.edu/policies/employment-non-us-citizens.php