Remote GRC Analyst III - Security Risk & Compliance Lead

Milliman, Inc; New York (NY); Remote; USD 96,000 - 181,000; Full time

Benefits offered by this job

Medical, Dental and Vision

401(k) Plan with employer match

Discretionary Bonus Program

Paid Time Off

Life Insurance

Disability coverage

Job summary

Milliman, Inc is seeking a Governance, Risk & Compliance Analyst (GRC Analyst III) within the Global Corporate Services Information Security team to manage GRC activities, vendor risk, and continuous compliance across practices. You will develop dashboards, automate reporting, and lead contract/questionnaire reviews to strengthen security posture.

The role requires senior-level experience, cross-functional collaboration with Legal, Compliance, IT, and business teams, and the ability to translate

Qualifications

• 6–10 years of experience in information security, risk management, audit, compliance, GRC, or related IT roles.
• Hands-on security audit or assessment experience, preferably with a consultancy, professional services, finance, insurance, or similar organization.
• Experience with ISO/IEC 27000 series, NIST Cybersecurity Framework, HITRUST CSF, HIPAA, SOC 2, and related security/control frameworks.
• Experience with security tools and technologies such as SIEM, VPN, TCP/IP, vulnerability scanning tools such as Qualys, Active Directory, proxy, firewall, IDS/IPS, routers/switches, and open-source information collection.
• Must have previous experience developing dashboards, metrics, KRIs/KPIs, executive reports, and remediation tracking.
• Must have advanced proficiency with Microsoft Word, Excel, OneNote, PowerPoint, and similar productivity tools.

Responsibilities

• Manage GRC activities and security reviews for Milliman Practices and the broader firm.
• Develop dashboards, workflows, and automated reporting to streamline GRC operations.
• Coordinate responses to external information security audits, SOC 2-related requests, and third-party inquiries.
• Design, create, and maintain AI agents and automations to support GRC activities.
• Maintain contract and questionnaire review libraries; ensure SLAs and templates are up to date.
• Monitor policy compliance, control gaps, overdue remediation, and risk trends; escalate as needed.

Skills

Information security

Risk management

Audit/compliance

GRC

Stakeholder management

Communication skills

Project management

Education

Bachelor’s or Master’s degree in CS/Engineering/Info Security

CISSP

CISA

CRISC

Tools

SIEM

VPN

Vulnerability scanning (Qualys)

Active Directory

Firewall

IDS/IPS

Cloud (Azure/AWS)

Open-source intel

Job description

Milliman, Inc is seeking a Governance, Risk & Compliance Analyst (GRC Analyst III) within the Global Corporate Services Information Security team to manage GRC activities, vendor risk, and continuous compliance across practices. You will develop dashboards, automate reporting, and lead contract/questionnaire reviews to strengthen security posture.

The role requires senior-level experience, cross-functional collaboration with Legal, Compliance, IT, and business teams, and the ability to translate