Compliance Analyst

About This Role

This role supports the day-to-day operation of the company's SOC 2 program and will help build out its ISO 42001 AI Management System (AIMS) and AI governance program over time. The immediate priority is keeping SOC 2 controls, evidence, and remediation on track throughout the year. The analyst will work with IT, Security, HR, Legal, and other control owners to turn compliance requirements into concrete tasks, keep evidence current, flag gaps early, and keep the organization audit-ready on an ongoing basis. The role reports to the Chief Compliance Officer, who retains ownership of the compliance program, and operationalizes and maintains technology-related controls alongside IT while providing independent compliance oversight.

Responsibilities

• Coordinate evidence collection, validation, and remediation across control owners; follow up on overdue or incomplete items
• Maintain audit readiness year-round rather than treating SOC 2 as an annual exercise
• Identify control gaps, exceptions, and deficiencies, and coordinate remediation with the responsible team
• Support SOC 2 Type 2 audit fieldwork and auditor requests
• Escalate overdue or material issues to the CCO and relevant IT/business leadership
• Operate and maintain Drata day to day, including API integrations and automated evidence sources
• Investigate and remediate failed automated tests and compliance exceptions
• Keep evidence complete, accurate, and correctly mapped to controls
• Look for ways to automate manual evidence collection and cut recurring effort
• Support building the AIMS: policies, procedures, controls, risk assessments, and supporting documentation
• Help build and maintain an inventory of AI systems, applications, and use cases
• Coordinate AI risk and impact assessments, control activities, and evidence collection
• Work with IT and business stakeholders to put AI governance requirements into practice
• Support future ISO 42001 readiness assessments and certification work
• Maintain the SaaS/technology inventory
• Support security and compliance reviews for new and existing vendors (SOC reports, questionnaires, certifications, contract requirements)
• Track vendor compliance gaps and remediation, and keep related evidence current for SOC 2 and applicable ISO 42001 requirements
• Maintain the risk register and coordinate periodic updates with risk owners
• Support information security, technology, third-party, and AI-related risk assessments
• Facilitate quarterly access reviews and track completion and remediation
• Escalate material or overdue risks to the CCO and appropriate leadership
• Organize and maintain documentation for SOC 2 and ISO 42001 assessments