[Hiring] Governance, Risk and Compliance Analyst III @Milliman

Role Description

The Governance, Risk & Compliance Analyst (GRC Analyst III) is a senior level role within the Global Corporate Services Information Security team. This position supports Milliman Practices and the broader firm by managing GRC activities, internal security reviews, contract and questionnaire reviews, audit coordination, vendor risk management, security awareness reporting, automation, AI agent creation, and continuous compliance monitoring.

The role validates compliance with the Milliman Information Security Policy, identifies risks and control gaps, provides consultative guidance to improve security posture, and develops dashboards, workflows, and automated reporting to streamline GRC operations.

Responsibilities

• Contract, Questionnaire, and Document Review
  • Serve as a key point of contact for information security contract terms, IS questionnaires, RFPs/RFQs, MSAs, BAAs, addenda, and related inquiries.
  • Review legal agreements and client documentation to ensure consistency with the Milliman Information Security Policy and applicable privacy/security requirements.
  • Collaborate regularly with Legal, Compliance, Information Security, and business teams.
  • Track contract and inquiry status to ensure internal service-level agreements are met.
  • Maintain approved response libraries, templates, and workflow routing for recurring inquiries.
• GRC Dashboard, Reporting, and Continuous Compliance
  • Create, maintain, and enhance GRC dashboards covering internal reviews, audit readiness, training compliance, vendor risk, KRIs/KPIs, remediation, and control effectiveness.
  • Develop recurring compliance reports for leadership, risk committees, auditors, and Board-level reporting.
  • Support continuous compliance monitoring through automated evidence collection, exception tracking, alerts, and escalation workflows.
  • Monitor policy compliance, control gaps, overdue remediation, and risk trends.
  • Support compliance enforcement through reporting, follow-up, escalation, and remediation tracking.
• Automation, AI Agents, and Workflow Improvement
  • Design, create, and maintain AI agents and automations to support GRC activities such as security questionnaire responses, contract review triage, control mapping, audit evidence collection, vendor intake, compliance reminders, and status reporting.
  • Streamline GRC workflows for intake, review, approval, evidence collection, escalation, remediation, and reporting.
  • Validate AI-generated and automated outputs for accuracy, consistency, and compliance with approved guidance.
  • Document automated workflows, control points, exceptions, and maintenance requirements.
• Audit Coordination and Repository Support
  • Coordinate responses to external information security audits, SOC 2-related requests, technology/security assessments, and ad hoc third-party auditor inquiries.
  • Support audit requests for Corporate IT shared services and remote Milliman offices.
  • Maintain secure audit repositories and ensure timely evidence delivery and closure.
  • Coordinate responses across Practices when common clients or shared audit requirements arise.
• Vendor Risk Management
  • Support the Vendor Risk Management program, including vendor identification, risk assessments, documentation review, and reporting.
  • Maintain visibility into critical vendors and monitor key risk indicators.
  • Escalate vendor risks, control gaps, or changes in exposure to appropriate stakeholders or risk committees.
  • Automate vendor intake, reassessment reminders, evidence collection, risk scoring, and reporting where feasible.
• Security Awareness and Compliance Support
  • Administer and report on information security awareness training compliance for employees and contractors.
  • Maintain metrics, dashboards, reminders, escalations, and evidence of completion.
  • Identify trends, overdue training, and opportunities for targeted awareness improvement.

Qualifications

• 6–10 years of experience in information security, risk management, audit, compliance, GRC, or related IT roles.
• Hands-on security audit or assessment experience, preferably with a consultancy, professional services, finance, insurance, or similar organization.
• Experience with ISO/IEC 27000 series, NIST Cybersecurity Framework, HITRUST CSF, HIPAA, SOC 2, and related security/control frameworks.
• Experience with security tools and technologies such as SIEM, VPN, TCP/IP, vulnerability scanning tools such as Qualys, Active Directory, proxy, firewall, IDS/IPS, routers/switches, and open-source information collection.
• Previous experience developing dashboards, metrics, KRIs/KPIs, executive reports, and remediation tracking.
• Advanced proficiency with Microsoft Word, Excel, OneNote, PowerPoint, and similar productivity tools.
• Strong understanding of security principles, audit practices, policies, guidelines, compliance, and risk management.
• Strong technical knowledge of enterprise systems and security areas, including networking, operating systems, identity and access management, secure SDLC, and cloud technologies such as Azure or AWS.
• Ability to interpret security data, identify compliance issues, and translate complex technical topics into clear business language.
• Excellent project management skills, including the ability to prioritize and manage complex work independently.
• Strong communication, presentation, problem-solving, and stakeholder management skills.
• Ability to lead, influence, and collaborate with information security teams, technical partners, business leaders, Legal, Compliance, auditors, and senior management.
• Ability to work effectively in a globally distributed organization and understand international information security regulations.
• Willingness to travel occasionally.

Requirements

• Bachelor’s or Master’s degree in Computer Science, Engineering, Information Security, or related field.
• CISSP, CISA, CRISC, or equivalent certification.
• Experience with automation, workflow creation, AI-enabled tools, or GRC/reporting platforms.

Location

This is a remote role.

Compensation

The overall range for this role is $95,574 - $181,228. For candidates residing in:

• Alaska, California, Connecticut, Illinois, Maryland, Massachusetts, New Jersey, New York City, Pennsylvania, Virginia, Washington, or the District of Columbia: $109,910 - $181,228.
• All other locations: $95,574 - $157,590.

A combination of factors will be considered, including, but not limited to, education, relevant work experience, qualifications, skills, certifications, etc.

Benefits

• Medical, Dental and Vision – Coverage for employees, dependents, and domestic partners.
• Employee Assistance Program (EAP) – Confidential support for personal and work-related challenges.
• 401(k) Plan – Includes a company matching program and profit-sharing contributions.
• Discretionary Bonus Program – Recognizing employee contributions.
• Flexible Spending Accounts (FSA) – Pre-tax savings for dependent care, transportation, and eligible medical expenses.
• Paid Time Off (PTO) – Begins accruing on the first day of work. Full-time employees accrue 15 days per year, and employees working less than full-time accrue PTO on a prorated basis.
• Holidays – A minimum of 10 paid holidays per year.
• Family Building Benefits – Includes adoption and fertility assistance.
• Paid Parental Leave – 11 weeks of paid leave for employees who meet eligibility criteria.
• Life Insurance & AD&D – 100% of premiums covered by Milliman.
• Short-Term and Long-Term Disability – Fully paid by Milliman.