Senior GRC Analyst — Risk, Compliance & Automation (Remote)

Milliman; New York (NY); Remote; USD 96,000 - 181,000; Full time

Benefits offered by this job

Medical, Dental and Vision – Coverage

401(k) plan

Discretionary bonus program

PTO 15 days/yr

Holidays 10+ per year

Life Insurance & AD&D

Short-Term and Long-Term Disability

Job summary

Milliman is seeking a Governance, Risk & Compliance Analyst III for the Global Corporate Services Information Security team. The role focuses on managing GRC activities, contract reviews, audits, vendor risk, and automation to streamline compliance and reporting.

It requires experience across ISO/NIST/HIPAA/SOC 2 and strong ability to translate complex security topics for executives. The position supports multiple practices, enables continuous monitoring, and involves occasional travel.

Qualifications

• 6–10 years of experience in information security, risk management, audit, compliance, GRC, or related IT roles.
• Hands-on security audit or assessment experience, preferably in consultancy, professional services, finance, insurance, or similar.
• Experience with ISO/IEC 27000 series, NIST CSF, HITRUST CSF, HIPAA, SOC 2, and related frameworks.
• Experience with security tools and technologies such as SIEM, VPN, TCP/IP, vulnerability scanning (Qualys), AD, proxy, firewall, IDS/IPS, routers/switches, and open-source information collection.
• Proven ability to develop dashboards, metrics, KRIs/KPIs, executive reports, and remediation tracking.
• Proficient with Microsoft Word, Excel, OneNote, PowerPoint.

Responsibilities

• Serve as a key contact for information security contracts, questionnaires, RFPs/RFQs, and related inquiries.
• Review agreements to ensure alignment with Milliman Information Security Policy and privacy/security requirements.
• Create and maintain GRC dashboards, reports, and continuous compliance monitoring.
• Design and maintain AI agents and automations to support GRC activities and workflows.
• Coordinate responses to external audits, SOC 2 requests, and third-party assessments.
• Support Vendor Risk Management via risk assessments, documentation, and reporting.
• Administer information security awareness training compliance and track progress.

Skills

Info security

Risk management

Audit experience

Compliance

GRC tools

Dashboards

Microsoft Office

Education

Bachelor’s or Master’s degree in Computer Science, Engineering, Information Security

Tools

SIEM

Active Directory

Qualys

Firewall

Job description

Milliman is seeking a Governance, Risk & Compliance Analyst III for the Global Corporate Services Information Security team. The role focuses on managing GRC activities, contract reviews, audits, vendor risk, and automation to streamline compliance and reporting.

It requires experience across ISO/NIST/HIPAA/SOC 2 and strong ability to translate complex security topics for executives. The position supports multiple practices, enables continuous monitoring, and involves occasional travel.