Governance, Risk and Compliance Analyst III

Milliman

. Serve as a key contact for information security contract terms, questionnaires, RFPs/RFQs, MSAs, BAAs, addenda, and related inquiries .

Posted 10/23/2026full-timeRemote • New York • United StatesMid-LevelSenior💰 $95,574 - $181,228 per yearWebsite

Core Competencies

Role fit

Core Competencies

Use this summary to align your resume positioning with the role.

Demonstrates expertise in information security, risk management, and compliance, with a strong focus on GRC frameworks and audit practices. Proficient in developing dashboards, metrics, and reports while ensuring adherence to security policies and regulations.

Highest-signal resume keywords

Information Security ManagementRisk Assessment and ManagementGRC Frameworks (ISO/IEC 27000, NIST, HITRUST, SOC 2)Security Audit ExperienceDashboard Development and Reporting

ATS Keywords

Tailor your resume

Applicant Tracking System Keywords

Tip: use these terms in your resume and cover letter to boost ATS matches.

Hard Skills

Information SecurityRisk ManagementComplianceAudit PracticesGRCSecurity PrinciplesTechnical Knowledge of NetworkingVulnerability Scanning ToolsDashboard DevelopmentProject Management

Soft Skills

Strong CommunicationProblem-SolvingStakeholder ManagementCollaborationPresentation Skills

Tools & Technologies

SIEMVPNTCP/IPQualysActive DirectoryAzureAWSMicrosoft WordMicrosoft ExcelMicrosoft PowerPoint

Industry Keywords

SOC 2HIPAAAudit ReadinessVendor Risk ManagementCompliance MonitoringControl EffectivenessKRI/KPIAutomated Evidence CollectionInternational Information Security RegulationsInformation Security Awareness Training

Tech Stack

Tools & technologies

AWSAzureCyber SecuritySDLCTCP/IP

About the role

Key responsibilities & impact

Serve as a key contact for information security contract terms, questionnaires, RFPs/RFQs, MSAs, BAAs, addenda, and related inquiries
Review legal agreements and client documentation for alignment with the Milliman Information Security Policy and privacy/security requirements
Collaborate with Legal, Compliance, Information Security, and business teams
Track contract and inquiry status against internal service-level agreements
Maintain response libraries, templates, and workflow routing
Create, maintain, and enhance GRC dashboards for internal reviews, audit readiness, training compliance, vendor risk, KRIs/KPIs, remediation, and control effectiveness
Develop recurring compliance reports for leadership, risk committees, auditors, and Board-level reporting
Support continuous compliance monitoring through automated evidence collection, exception tracking, alerts, and escalation workflows
Monitor policy compliance, control gaps, overdue remediation, and risk trends
Design and maintain AI agents and automations for questionnaire responses, contract review triage, control mapping, audit evidence collection, vendor intake, compliance reminders, and status reporting
Streamline GRC workflows for intake, review, approval, evidence collection, escalation, remediation, and reporting
Validate automated outputs for accuracy, consistency, and compliance
Coordinate external information security audits, SOC 2 requests, technology/security assessments, and third-party auditor inquiries
Maintain secure audit repositories and ensure timely evidence delivery and closure
Support the Vendor Risk Management program, including vendor identification, risk assessments, documentation review, and reporting
Automate vendor intake, reassessment reminders, evidence collection, risk scoring, and reporting where feasible
Administer and report on information security awareness training compliance
Maintain training metrics, dashboards, reminders, escalations, and completion evidence

Requirements

What you’ll need

6–10 years of experience in information security, risk management, audit, compliance, GRC, or related IT roles
Hands-on security audit or assessment experience
Experience with ISO/IEC 27000 series, NIST Cybersecurity Framework, HITRUST CSF, HIPAA, SOC 2, and related security/control frameworks
Experience with SIEM, VPN, TCP/IP, vulnerability scanning tools such as Qualys, Active Directory, proxy, firewall, IDS/IPS, routers/switches, and open-source information collection
Experience developing dashboards, metrics, KRIs/KPIs, executive reports, and remediation tracking
Advanced proficiency with Microsoft Word, Excel, OneNote, PowerPoint, and similar productivity tools
Strong understanding of security principles, audit practices, policies, guidelines, compliance, and risk management
Technical knowledge of enterprise systems and security areas, including networking, operating systems, identity and access management, secure SDLC, and Azure or AWS
Ability to interpret security data, identify compliance issues, and translate complex technical topics into clear business language
Excellent project management skills and ability to prioritize and manage complex work independently
Strong communication, presentation, problem-solving, and stakeholder management skills
Ability to lead, influence, and collaborate with information security teams, technical partners, business leaders, Legal, Compliance, auditors, and senior management
Ability to work effectively in a globally distributed organization and understand international information security regulations
Willingness to travel occasionally
Must be legally authorized to work in the United States without immigration support or sponsorship now or in the future

Benefits

Comp & perks

Medical, Dental and Vision coverage for employees, dependents, and domestic partners
Employee Assistance Program (EAP)
401(k) plan with company matching and profit-sharing contributions
Discretionary Bonus Program
Flexible Spending Accounts (FSA)
Paid Time Off (PTO), accruing from the first day of work; 15 days per year for full-time employees
Minimum of 10 paid holidays per year
Family Building Benefits, including adoption and fertility assistance
11 weeks of paid parental leave for eligible employees
Life Insurance & AD&D, with 100% of premiums covered by Milliman
Fully paid short-term and long-term disability
Remote work arrangement