IT Risk & Compliance Specialist

JOB SUMMARY: NORC at the University of Chicago is seeking a seasoned IT Risk and Compliance Specialist to join our Information Technology Department within the DSS Security and Compliance team. This critical role will focus primarily on continuous monitoring of security controls, risks, vulnerabilities, and compliance activities , with additional responsibility for supporting and administering compliance activities within ServiceNow GRC/IRM and conducting internal and external compliance assessments and audits. The ideal candidate will bring strong experience in continuous monitoring, governance, risk, and compliance activities within regulated environments, particularly those supporting Government security requirements such as FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, and ISO 27001. Preferably, this position will have a hybrid work schedule of one or two days a week in either our Washington, DC or Chicago, IL office. Remote applicants may also be considered. DEPARTMENT: Digital Services & Solutions Security & Compliance NORC's Digital Services & Solutions group provides technology services to our staff and clients. Given the critical role technology plays in our day-to-day lives, we are committed to providing professional, high-quality solutions in order to further our collective goal of advancing social science research. RESPONSIBILITIES: Perform and support continuous monitoring activities across NORC systems and environments to assess the ongoing effectiveness of security controls and identify changes that may impact system risk or compliance. Monitor security and compliance findings, vulnerabilities, control deficiencies, remediation activities, exceptions, and other risk indicators to ensure issues are appropriately documented, assigned, tracked, and resolved. Review continuous monitoring outputs from security and IT tools and work with Security Engineers, system owners, and other stakeholders to evaluate findings, determine compliance impact, and coordinate remediation. Track and report on Corrective Action Plans (CAPs), Plans of Action and Milestones (POA&Ms), control deficiencies, vulnerabilities, exceptions, and remediation activities , including aging, status, ownership, and closure. Perform recurring reviews of security controls and supporting evidence to validate continued compliance with requirements such as FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, ISO 27001, FISMA, HITRUST, and applicable contractual requirements. Conduct Security Impact Analyses (SIAs) and risk assessments for system, infrastructure, application, and configuration changes to determine potential impacts to security controls, compliance requirements, and organizational risk. Utilize and support ServiceNow GRC/IRM to manage controls, risks, issues, findings, evidence, remediation activities, exceptions, and other compliance-related workflows. Maintain accurate and complete GRC records within ServiceNow, ensuring compliance activities, control assessments, findings, risks, and remediation efforts are appropriately documented and traceable. Support the development, configuration, and improvement of ServiceNow GRC/IRM workflows, dashboards, reporting, control mappings, and automated compliance processes to improve visibility and efficiency across the compliance program. Develop and maintain compliance metrics, dashboards, and reporting that provide visibility into control effectiveness, outstanding findings, remediation progress, risk trends, and overall compliance posture. Support internal and external IT compliance audits and assessments , including evidence collection, control validation, documentation review, auditor coordination, and remediation tracking for frameworks such as FedRAMP, CMMC, NIST 800-171, and ISO 27001. Develop, review, and maintain key security and compliance documentation, including System Security Plans (SSPs), Corrective Action Plans (CAPs), POA&Ms, Contingency Plans, control implementation documentation, policies, procedures, and supporting evidence . Collaborate with Security Engineers, system owners, application teams, and other stakeholders to remediate security and compliance issues and maintain alignment with applicable regulatory and contractual requirements. Assist in the development and improvement of policies, procedures, control processes, and automated compliance activities for hybrid and multi-tenant infrastructures. Translate regulatory, contractual, and security control requirements into actionable technical and operational steps for IT teams and system owners. Foster strong, collaborative relationships with NORC’s research community, IT teams, and other key stakeholders to support a culture of security, risk awareness, and continuous compliance. REQUIRED SKILLS: Bachelor’s Degree in Management Information Systems, Computer Science, Business Administration, or a related field. Equivalent experience in IT security, risk, or compliance may be considered. Current certification in IT security, risk, or compliance, such as Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or Certified in Risk and Information Systems Control (CRISC) . Minimum of 6+ years of experience in IT security, continuous monitoring, risk assessment, compliance, or auditing, with significant experience supporting government security frameworks and contractual requirements. Demonstrated experience performing continuous monitoring activities , including security control reviews, vulnerability and finding management, remediation tracking, compliance evidence review, risk identification, and reporting. Experience performing Security Impact Analyses, risk assessments, and control assessments for information systems and technology changes. Hands-on experience working with ServiceNow GRC/IRM or comparable Governance, Risk, and Compliance platforms , including managing controls, risks, issues, findings, evidence, and remediation activities. Experience developing or maintaining GRC workflows, dashboards, metrics, reporting, and compliance tracking processes . Experience supporting internal and external audits and assessments, including preparing and reviewing System Security Plans (SSPs), Corrective Action Plans (CAPs), POA&Ms, Contingency Plans, and control evidence . Strong working knowledge of security and compliance frameworks, including FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, ISO 27001, FISMA, and HITRUST . Strong understanding of information security controls across infrastructure layers, including networks, servers, databases, cloud environments, and applications. Experience supporting compliance within hybrid and multi-tenant infrastructures and familiarity with privacy requirements such as GDPR, CCPA/CPRA, HIPAA Security Rule, and HIPAA Privacy Rule. Qualified applicants must be eligible to work in the U.S. We regret that we are unable to offer visa sponsorship for this position. SALARY AND BENEFITS: The pay range for this position is $110,000 – $165,000. This position is classified as regular. Regular staff are eligible for NORC’s comprehensive benefits program. Benefits include, but are not limited to: Generously subsidized health insurance, effective on the first day of employment Dental and vision insurance A defined contribution retirement program, along with a separate voluntary 403(b) retirement program Group life insurance, long-term and short-term disability insurance Benefits that promote work/life balance, including generous paid time off, holidays; paid parental leave, bereavement leave, tuition assistance, and an Employee Assistance Program (EAP). NORC is committed to equity and transparency in its pay practices. We publish salary ranges and benefit information for every job. The listed hiring range reflects what we, in good faith, expect to pay at the time of posting, though actual compensation may vary and may be adjusted over time. A candidate’s placement within the range depends on factors such as competencies, education, qualifications, experience, skills, performance, and organizational needs. WHAT WE DO: NORC at the University of Chicago is an objective, non-partisan research institution that delivers reliable data and rigorous analysis to guide critical programmatic, business, and policy decisions. Since 1941, our teams have conducted groundbreaking studies, created and applied innovative methods and tools, and advanced principles of scientific integrity and collaboration. Today, government, corporate, and nonprofit clients around the world partner with us to transform increasingly complex information into useful knowledge. WHO WE ARE: For over 80 years, NORC has evolved in many ways, moving the needle with research methods, technical applications and groundbreaking research findings. But our tradition of excellence, passion for innovation, and commitment to collegiality have remained constant components of who we are as a brand, and who each of us is as a member of the NORC team. With world-class benefits, a business casual environment, and an emphasis on continuous learning, NORC is a place where people join for the stellar research and analysis work for which we’re known, and stay for the relationships they form with their colleagues who take pride in the impact their work is making on a global scale. EEO STATEMENT: NORC is an equal opportunity employer. NORC evaluates qualified applicants without regard to race, color, religion, sex, gender, national origin, disability, status as a protected veteran, sexual orientation, and other legally protected characteristics.