Senior IT Compliance Analyst

The Senior IT Compliance Analyst is responsible for leading and coordinating the organization's IT compliance, regulatory, certification, and audit programs. This role serves as the primary compliance lead for Sarbanes-Oxley (SOX) IT General Controls (ITGC) compliance, UK Cyber Essentials Plus certification, and various regulatory audits and certification initiatives. The role also supports strategic compliance programs including Cybersecurity Maturity Model Certification (CMMC), European cybersecurity regulations such as NIS2 and the Cyber Resilience Act (CRA), and assists business units pursuing elective certifications including SOC 2 and ISO 27001.

This position will work closely with IT Operations, Audit Services, Legal, Risk Management, Product Development, Engineering, Human Resources, and business stakeholders to ensure compliance obligations are understood, implemented, tested, and continuously monitored. The ideal candidate is a highly organized compliance professional with strong audit experience, regulatory knowledge, and the ability to translate complex requirements into practical business controls.

Key Responsibilities:

SOX Compliance Program Leadership

• Serve as the primary coordinator for IT Sarbanes-Oxley (SOX) compliance activities.
• Manage the annual IT General Controls (ITGC) assessment program.
• Partner with Internal Audit, External Audit, and IT control owners to coordinate testing activities and evidence collection.
• Track control deficiencies, remediation plans, and management responses.
• Prepare executive reporting on compliance status, findings, and remediation progress.

Cyber Essentials Plus and Certification Management

• Collaborate with each business in-scope for an annual UK Cyber Essentials Plus certification process.
• Coordinate internal readiness assessments and remediation activities.
• Work with technology teams to address certification gaps and maintain compliance.
• Manage relationships with certification bodies, assessors, and external auditors.
• Develop and maintain compliance documentation required for certification renewals.
• Monitor evolving certification requirements and recommend necessary program updates.

CMMC Readiness and Compliance Support

• Support the organization's Cybersecurity Maturity Model Certification (CMMC) program.
• Assist with NIST 800-171 control implementation, testing, and evidence collection.
• Coordinate compliance assessments and readiness reviews.
• Work with system owners to identify compliance gaps and remediation strategies.
• Support documentation efforts including System Security Plans (SSPs), Policies, Procedures, and Plans of Action & Milestones (POA&Ms).
• Monitor changes to CMMC requirements and associated DoD guidance.

European Regulatory Compliance

• Support organizational readiness for evolving European cybersecurity regulations, including:
• NIS2 Directive
• Cyber Resilience Act (CRA)
• GDPR-related cybersecurity obligations
• Other emerging EU cyber and technology regulations
• Assist in gap assessments, control mapping, and remediation planning activities.
• Collaborate with Legal, Security Operations, and business stakeholders to evaluate compliance impacts.
• Maintain compliance obligations inventories and regulatory tracking mechanisms.
• Support regulatory reporting and documentation requirements as applicable.

SOC 2, ISO 27001, and Elective Certification Support

• Partner with business units and technology teams pursuing voluntary compliance certifications.
• Support readiness assessments and gap analyses for SOC 2 & ISO 27001
• Additional customer-driven security certifications
• Assist in control design, implementation, testing, and evidence management.
• Coordinate with external assessors and certification bodies throughout assessment cycles.
• Help establish sustainable compliance monitoring and continuous improvement processes.

Governance and Control Framework Management

• Develop and maintain IT compliance control documentation.
• Map controls across multiple regulatory and certification frameworks to reduce duplication and increase efficiency.
• Evaluate control effectiveness and identify opportunities for process improvement.
• Maintain compliance inventories, obligations registers, and control libraries.
• Support enterprise risk management initiatives by identifying compliance risks and recommending mitigation strategies.

Required Qualifications:

• Bachelor's degree in Information Technology, Information Security, Cybersecurity, Accounting, Business Administration, Compliance, Audit, or a related field.
• 4-8+ years of experience in IT Compliance, IT Audit, Information Security, Risk Management, or Governance, Risk & Compliance (GRC).
• Demonstrated experience leading SOX ITGC compliance programs.
• Experience coordinating external audits and certification assessments.
• Strong understanding of IT controls, cybersecurity principles, and regulatory compliance requirements.
• Experience working with multiple compliance frameworks simultaneously.
• Excellent written, verbal, analytical, and presentation skills.
• Strong project management and stakeholder management abilities.

Preferred Qualifications:

Certifications

• CISA, CISM, CRISC, or CISSP
• ISO 27001 Lead Implemented or Lead Auditor
• CMMC CCP (Certified CMMC Professional)

Framework & Regulatory Knowledge

• Experience with: SOX, COBIT, NIST CSF, NIST 800-53, NIST 800-171, SOC 1, SOC 2, ISO 27001, UK Cyber Essentials Plus, NIS2, Cyber Resilience Act (CRA), GDPR, PCI DSS

Tools & systems

• Experience using ServiceNow, Microsoft Purview, Oracle, SAP ECC and S/4, Navision, HFM, OneStream, SSRS

Applicants must have the legal right to work in the United States on a full-time basis without the need for employer sponsorship now or in the future. The Company cannot offer employment to F-1 (student) visa holders who require employer sponsorship in the future or cannot work now on a full-time basis.