[Remote] Compliance Analyst

Note: The job is a remote job and is open to candidates in USA. Allia Health Group is seeking a Compliance Analyst to support daily SOC 2 operations and maintain year-round audit readiness. The role coordinates evidence collection, control remediation, vendor and risk reviews, reporting, and the development of the company’s ISO 42001 and AI governance program.

Responsibilities

• Coordinate evidence collection, validation, and remediation across control owners; follow up on overdue or incomplete items
• Maintain audit readiness year-round rather than treating SOC 2 as an annual exercise
• Identify control gaps, exceptions, and deficiencies, and coordinate remediation with the responsible team
• Support SOC 2 Type 2 audit fieldwork and auditor requests
• Escalate overdue or material issues to the CCO and relevant IT/business leadership
• Operate and maintain Drata day to day, including API integrations and automated evidence sources
• Investigate and remediate failed automated tests and compliance exceptions
• Keep evidence complete, accurate, and correctly mapped to controls
• Look for ways to automate manual evidence collection and cut recurring effort
• Support building the AIMS: policies, procedures, controls, risk assessments, and supporting documentation
• Help build and maintain an inventory of AI systems, applications, and use cases
• Coordinate AI risk and impact assessments, control activities, and evidence collection
• Work with IT and business stakeholders to put AI governance requirements into practice
• Support future ISO 42001 readiness assessments and certification work
• Maintain the SaaS/technology inventory
• Support security and compliance reviews for new and existing vendors (SOC reports, questionnaires, certifications, contract requirements)
• Track vendor compliance gaps and remediation, and keep related evidence current for SOC 2 and applicable ISO 42001 requirements
• Maintain the risk register and coordinate periodic updates with risk owners
• Support information security, technology, third-party, and AI-related risk assessments
• Facilitate quarterly access reviews and track completion and remediation
• Escalate material or overdue risks to the CCO and appropriate leadership
• Organize and maintain documentation for SOC 2 and ISO 42001 assessments
• Coordinate responses to auditor and assessor requests, and maintain audit trails
• Track findings and corrective actions through closure
• Build monthly compliance and IT dashboards for leadership: MFA coverage, access review completion, onboarding/offboarding SLAs, evidence completion, remediation status, vendor reviews, and trends
• Surface upcoming deadlines, overdue items, and risks that need management attention

Skills

• 2–5 years in compliance, GRC, information security, IT audit, or risk management
• Working knowledge of SOC 2 and information security controls
• Experience with a GRC/continuous compliance platform (Drata, Vanta, Secureframe, or similar)
• Experience coordinating evidence collection and remediation across technical and business teams
• Familiarity with NIST, ISO 27001, or CIS Controls
• Strong organizational skills and comfort managing multiple stakeholders and deadlines
• Strong written and verbal communication
• Able to work independently, spot gaps, and drive issues to resolution
• Applicants must be legally authorized to work in the United States without the need for current or future sponsorship
• Experience supporting ISO 42001 or another AI management system
• Experience with AI governance, AI risk assessments, or emerging technology risk
• HIPAA or healthcare compliance experience, ideally in a technology or regulated environment
• ISO 27001 or other ISO management-system experience
• CISA, CISM, CRISC, Security+, ISO 27001, or ISO 42001 certification or training

Benefits

• Full benefits package including medical, vision, dental, 401(k) with company match, PTO, Flex days, holidays, and more!

Company Overview