Governance, Risk and Compliance Analyst III (GRC Analyst III)

NOTE: Individual(s) must be legally authorized to work in the United States without the need for immigration support or sponsorship from Milliman now or in the future.

POSITION SUMMARY:

The Governance, Risk & Compliance Analyst (GRC Analyst III) is a senior level role within the Global Corporate Services Information Security team. This position supports Milliman Practices and the broader firm by managing GRC activities, internal security reviews, contract and questionnaire reviews, audit coordination, vendor risk management, security awareness reporting, automation, AI agent creation, and continuous compliance monitoring.

The role validates compliance with the Milliman Information Security Policy, identifies risks and control gaps, provides consultative guidance to improve security posture, and develops dashboards, workflows, and automated reporting to streamline GRC operations.

RESPONSIBILITIES: (in order of priority)

Contract, Questionnaire, and Document Review

• Serve as a key point of contact for information security contract terms, IS questionnaires, RFPs/RFQs, MSAs, BAAs, addenda, and related inquiries.
• Review legal agreements and client documentation to ensure consistency with the Milliman Information Security Policy and applicable privacy/security requirements.
• Collaborate regularly with Legal, Compliance, Information Security, and business teams.
• Track contract and inquiry status to ensure internal service-level agreements are met.
• Maintain approved response libraries, templates, and workflow routing for recurring inquiries.

GRC Dashboard, Reporting, and Continuous Compliance

• Create, maintain, and enhance GRC dashboards covering internal reviews, audit readiness, training compliance, vendor risk, KRIs/KPIs, remediation, and control effectiveness.
• Develop recurring compliance reports for leadership, risk committees, auditors, and Board-level reporting.
• Support continuous compliance monitoring through automated evidence collection, exception tracking, alerts, and escalation workflows.
• Monitor policy compliance, control gaps, overdue remediation, and risk trends.
• Support compliance enforcement through reporting, follow-up, escalation, and remediation tracking.

Automation, AI Agents, and Workflow Improvement

• Design, create, and maintain AI agents and automations to support GRC activities such as security questionnaire responses, contract review triage, control mapping, audit evidence collection, vendor intake, compliance reminders, and status reporting.
• Streamline GRC workflows for intake, review, approval, evidence collection, escalation, remediation, and reporting.
• Validate AI-generated and automated outputs for accuracy, consistency, and compliance with approved guidance.
• Document automated workflows, control points, exceptions, and maintenance requirements.

Audit Coordination and Repository Support

• Coordinate responses to external information security audits, SOC 2-related requests, technology/security assessments, and ad hoc third-party auditor inquiries.
• Support audit requests for Corporate IT shared services and remote Milliman offices.
• Maintain secure audit repositories and ensure timely evidence delivery and closure.
• Coordinate responses across Practices when common clients or shared audit requirements arise.

Vendor Risk Management

• Support the Vendor Risk Management program, including vendor identification, risk assessments, documentation review, and reporting.
• Maintain visibility into critical vendors and monitor key risk indicators.
• Escalate vendor risks, control gaps, or changes in exposure to appropriate stakeholders or risk committees.
• Automate vendor intake, reassessment reminders, evidence collection, risk scoring, and reporting where feasible.

Security Awareness and Compliance Support

• Administer and report on information security awareness training compliance for employees and contractors.
• Maintain metrics, dashboards, reminders, escalations, and evidence of completion.
• Identify trends, overdue training, and opportunities for targeted awareness improvement.

SKILLS & QUALIFICATIONS REQUIRED:

• The ideal candidate must have 6–10 years of experience in information security, risk management, audit, compliance, GRC, or related IT roles.
• The ideal candidate must have hands-on security audit or assessment experience, preferably with a consultancy, professional services, finance, insurance, or similar organization.
• The ideal candidate must have experience with ISO/IEC 27000 series, NIST Cybersecurity Framework, HITRUST CSF, HIPAA, SOC 2, and related security/control frameworks.
• The ideal candidate must have experience with security tools and technologies such as SIEM, VPN, TCP/IP, vulnerability scanning tools such as Qualys, Active Directory, proxy, firewall, IDS/IPS, routers/switches, and open-source information collection.
• Must have previous experience developing dashboards, metrics, KRIs/KPIs, executive reports, and remediation tracking.
• Must have advanced proficiency with Microsoft Word, Excel, OneNote, PowerPoint, and similar productivity tools.
• Must have strong understanding of security principles, audit practices, policies, guidelines, compliance, and risk management.
• Must have strong technical knowledge of enterprise systems and security areas, including networking, operating systems, identity and access management, secure SDLC, and cloud technologies such as Azure or AWS.
• Must have the ability to interpret security data, identify compliance issues, and translate complex technical topics into clear business language.
• Must have excellent project management skills, including the ability to prioritize and manage complex work independently.
• Must have strong communication, presentation, problem-solving, and stakeholder management skills.
• Must have the ability to lead, influence, and collaborate with information security teams, technical partners, business leaders, Legal, Compliance, auditors, and senior management.
• Must have the ability to work effectively in a globally distributed organization and understand international information security regulations.
• Must have willingness to travel occasionally.

SKILLS & QUALIFICATIONS PREFERRED:

• Bachelor’s or Master’s degree in Computer Science, Engineering, Information Security, or related field.
• CISSP, CISA, CRISC, or equivalent certification.
• Experience with automation, workflow creation, AI-enabled tools, or GRC/reporting platforms.

LOCATION:

• This is a remote role. The expected application deadline for this job is October 29, 2026

COMPENSATION:

The overall range for this role is $95,574 - $181,228.

For candidates residing in:

• Alaska, California, Connecticut, Illinois, Maryland, Massachusetts, New Jersey, New York City, Pennsylvania, Virginia, Washington, or the District of Columbia the range is $109,910 - $181,228.

• All other locations the range is $95,574 - $157,590.

A combination of factors will be considered, including, but not limited to, education, relevant work experience, qualifications, skills, certifications, etc. 

BENEFITS:

We offer a comprehensive benefits package designed to support employees’ health, financial security, and well-being. Benefits include:

• Medical, Dental and Vision – Coverage for employees, dependents, and domestic partners.

• Employee Assistance Program (EAP) – Confidential support for personal and work-related challenges.

• 401(k) Plan – Includes a company matching program and profit-sharing contributions.

• Discretionary Bonus Program – Recognizing employee contributions.

• Flexible Spending Accounts (FSA) – Pre-tax savings for dependent care, transportation, and eligible medical expenses.

• Paid Time Off (PTO) – Begins accruing on the first day of work. Full-time employees accrue 15 days per year, and employees working less than full-time accrue PTO on a prorated basis.

• Holidays – A minimum of 10 paid holidays per year.

• Family Building Benefits – Includes adoption and fertility assistance.

• Paid Parental Leave – 11 weeks of paid leave for employees who meet eligibility criteria.

• Life Insurance & AD&D – 100% of premiums covered by Milliman.

• Short-Term and Long-Term Disability – Fully paid by Milliman.

ABOUT MILLIMAN:

Independent for over 77 years, Milliman delivers market-leading services and solutions to clients worldwide. Today, we are helping companies take on some of the world’s most critical and complex issues, including retirement funding and healthcare financing, risk management and regulatory compliance, data analytics and business transformation.

Through a team of professionals ranging from actuaries to clinicians, technology specialists to plan administrators, we offer unparalleled expertise in employee benefits, investment consulting, healthcare, life insurance and financial services, and property and casualty insurance.

EQUAL OPPORTUNITY:

All qualified applicants will receive consideration for employment, without regard to race, color, religion, sex, sexual orientation, national origin, disability, or status as a protected veteran.