Policy Analyst

Smartsuite; Newport Beach (CA); On-site; USD 70,000 - 110,000; Full time

Job summary

Capitolis in Newport Beach is seeking a Policy Analyst to support the policy program, drafting and formatting documents, running review and attestation workflows, and maintaining the policy register with its mappings. They keep the policy library accurate and searchable, ensuring timely responses to policy queries from the business.

The role emphasizes collaboration with Compliance and HR teams, preparing status and attestation reports, and ensuring alignment with ISO, SOC 2, SOX, GDPR and HIPAA

Qualifications

• Draft and format policy documents to the house standard.
• Run review, approval and attestation workflows.
• Maintain the policy register, metadata and mappings to controls.
• Chase overdue reviews and acknowledgements.
• Prepare policy status and attestation reports.
• Answer policy queries from the business.

Responsibilities

• Draft and format policy documents to the house standard.
• Run review, approval and attestation workflows.
• Maintain the policy register, metadata and mappings to controls.
• Chase overdue reviews and acknowledgements.
• Prepare policy status and attestation reports.
• Answer policy queries from the business.

Skills

Policy drafting

Document formatting

Workflow coordination

Policy register management

Attestation processes

Tools

SmartSuite

Job description

Governance, risk and compliance

SmartSuite for the Policy Analyst

The Policy Analyst supports the policy program: drafting and formatting documents, running review and attestation workflows, maintaining the policy register and its mappings, and chasing overdue acknowledgements. They keep the policy library accurate and searchable.

Reports to:

Policy and Governance Manager

What you own

The Policy Analyst supports the policy program: drafting and formatting documents, running review and attestation workflows, maintaining the policy register and its mappings, and chasing overdue acknowledgements.

• Draft and format policy documents to the house standard
• Run review, approval and attestation workflows
• Maintain the policy register, metadata and mappings to controls
• Chase overdue reviews and acknowledgements
• Prepare policy status and attestation reports
• Answer policy queries from the business

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Policy management

Touches

contributes or approves

Compliance management

Reporting

Depends on

consumes its output

Internal audit

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Policy Analyst: navy is owned, blue is touched, grey is depended on.

1. First line The business and its control owners Run the processes, own the controls, fix the issues
2. Second line Risk, compliance and the domain programmes Set the frameworks, assess, monitor and advise
3. Third line Internal audit Independent assurance to the board and audit committee

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Policy and Governance Manager

See the role

Works closely with

Compliance Analyst

See the role

Regulatory Change Manager

See the role

HR Operations Manager

See the role

How SmartSuite supports the Policy Analyst

The Policy Analyst keeps the policy library accurate, routed and searchable, and the Policy and Governance Manager, auditors checking review dates and employees asking what applies rely on the register being right. SmartSuite runs the workflows, holds the register and records every acknowledgement, so the analyst's week is spent on policy content, not chasing.

Keep the policy register accurate and routed

Drafts that start from the house template

Standardized templates and structured workflows give every new policy the house format, metadata and approval route from the first draft, so formatting to standard is the starting point rather than a clean-up before approval.

Compliance Management suite

Mappings to controls kept current

Each policy in the register links to the controls and obligations it implements, mapped once and reused across ISO, SOC 2, SOX, GDPR and HIPAA, so updating a mapping is one edit, not a change in five spreadsheets.

Compliance Management suite

Versions and approvals on the record

Every policy keeps its controlled versions, approvals and review dates in its history, so the documentation standard ISO 37301 clause 7.5 sets is met by the register itself rather than by a separate log you maintain.

Compliance Management suite

Stay connected to compliance, regulatory change and HR

Regulatory changes routed to the right policy

Regulatory change visibility tracks updates, runs impact assessments and routes them to the policies affected, so when the Regulatory Change Manager flags a new rule the policy it touches is on your list with an owner.

Compliance Management suite

HR acknowledgements in the same register

Employee acknowledgements the HR Operations Manager runs for people policies are tracked in the same register as security and compliance policies, so one attestation campaign covers the handbook and the acceptable use policy together.

Compliance Management suite

Policy queries answered from the register

Cross-functional transparency gives Legal, IT, Security, HR and Ops the current policy, its owner and its status, so a question from the business is answered by sharing the record rather than by searching a shared drive.

Compliance Management suite

Evidence the program to assessors

Review dates assessors can verify

Full histories of approvals and review decisions are retained for external audits and regulators, so when a PCI DSS or FedRAMP assessor checks review dates and acknowledgement records the evidence is the register's own history.

Compliance Management suite

Retired policies kept as long as required

Policies, versions and acknowledgements are retained with their effective dates, so the HIPAA requirement to keep a policy for six years from its last effective date is met without an archive you manage by hand.

Compliance Management suite

Policy narratives drafted with the AI Assistant

Use the AI Assistant in a SmartDoc field to summarize controls and draft the compliance narrative that accompanies a policy, so the summary the Compliance Analyst needs for an assessment is drafted from the mapped controls rather than written fresh.

Compliance Management suite

Policy management. Runs review and attestation workflows, maintains the policy register and keeps mappings to controls current.

Issues and actions. Tracks overdue reviews and acknowledgements with automated reminders.

Reporting. Produces attestation and policy status reports by department.

Products this role uses most

Policy Management

Centralize creation, approval, and publication of policies with full lifecycle tracking and attestations, ensuring they remain current, accessible, and auditable.

Control Framework & Regulatory Libraries

Keep controls in one library and map them across frameworks to reduce duplication and enable a test-once, comply-many approach.

Issues Management

Track and remediate issues across audits, risk, and compliance with structured workflows, clear ownership, and real-time visibility into resolution status.

Industry reference

ISO 37301:2021 clause 7.5 sets the documentation standard the analyst maintains: controlled versions, approvals on record and periodic review. ISO/IEC 27001:2022 clause 7.5 and NIST SP 800-53's policy controls carry the same requirement into security programs, so one policy register usually serves several frameworks.

Sector rules set the detail. HIPAA requires policies to be retained for six years from their last effective date; FINRA expects written supervisory procedures to be current; FedRAMP and PCI DSS v4.0.1 assessors check review dates and acknowledgement records; public bodies often publish policies under freedom-of-information rules, which raises the bar on accuracy.

Related roles

Policy and Governance Manager

See the role

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The Policy Analyst supports the policy program day to day: drafting and formatting policy documents to the house standard, running review, approval and attestation workflows, maintaining the policy register with its metadata and mappings to controls, chasing overdue reviews and acknowledgements, preparing policy status and attestation reports and answering policy queries from the business. The Policy and Governance Manager owns the lifecycle; the analyst keeps the library accurate and searchable.

Policy Management runs review and attestation workflows, maintains the policy register and keeps mappings to controls current, so each policy moves through review and approval with the versions and approvals on record, attestation campaigns go out to the right people and the register shows every policy's status, owner and review date. Control Framework & Regulatory Libraries supplies the controls the policies map to, so one register serves ISO 37301, ISO 27001 and NIST SP 800-53 at once.

Overdue reviews and acknowledgements are tracked in Issues Management with automated reminders, so the analyst is not sending chasers by hand; the reminder goes to the policy owner whose review is late or the employee whose acknowledgement is missing, and the analyst sees what remains overdue by department. The HR Operations Manager works from the same acknowledgement record, which is how new starters and leavers are kept in step with the campaign.

SmartSuite produces attestation and policy status reports by department from the register and attestation records as they stand, so the analyst's report to the Policy and Governance Manager shows acknowledgement completion, overdue reviews and policies approaching their review date without a spreadsheet. The Compliance Analyst and Regulatory Change Manager see the same status, and when FedRAMP or PCI DSS assessors check review dates and acknowledgement records, the report is the record.

New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows. For a policy team the first workflow is the register: load the current policies with their owners, versions, approval dates and next review dates, then map each to the controls it implements and launch the first attestation campaign. Overdue items show immediately, which gives the analyst a chase list on the first day, and retention rules such as HIPAA's six years are met by keeping the versions on record.

See SmartSuite for your role

Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.