Governance, Risk and Compliance Analyst III (GRC Analyst III)

NOTE: Individual(s) must be legally authorized to work in the United States without the need for immigration support or sponsorship from Milliman now or in the future.

POSITION SUMMARY:

The Governance Risk & Compliance Analyst (GRC Analyst III) is a senior level role within the Global Corporate Services Information Security team. This position supports Milliman Practices and the broader firm by managing GRC activities internal security reviews contract and questionnaire reviews audit coordination vendor risk management security awareness reporting automation AI agent creation and continuous compliance monitoring.

The role validates compliance with the Milliman Information Security Policy identifies risks and control gaps provides consultative guidance to improve security posture and develops dashboards workflows and automated reporting to streamline GRC operations.

RESPONSIBILITIES: (in order of priority)

Contract Questionnaire and Document Review

• Serve as a key point of contact for information security contract terms IS questionnaires RFPs/RFQs MSAs BAAs addenda and related inquiries.
• Review legal agreements and client documentation to ensure consistency with the Milliman Information Security Policy and applicable privacy/security requirements.
• Collaborate regularly with Legal Compliance Information Security and business teams.
• Track contract and inquiry status to ensure internal service-level agreements are met.
• Maintain approved response libraries templates and workflow routing for recurring inquiries.

GRC Dashboard Reporting and Continuous Compliance

• Create maintain and enhance GRC dashboards covering internal reviews audit readiness training compliance vendor risk KRIs/KPIs remediation and control effectiveness.
• Develop recurring compliance reports for leadership risk committees auditors and Board-level reporting.
• Support continuous compliance monitoring through automated evidence collection exception tracking alerts and escalation workflows.
• Monitor policy compliance control gaps overdue remediation and risk trends.
• Support compliance enforcement through reporting follow-up escalation and remediation tracking.

Automation AI Agents and Workflow Improvement

• Design create and maintain AI agents and automations to support GRC activities such as security questionnaire responses contract review triage control mapping audit evidence collection vendor intake compliance reminders and status reporting.
• Streamline GRC workflows for intake review approval evidence collection escalation remediation and reporting.
• Validate AI-generated and automated outputs for accuracy consistency and compliance with approved guidance.
• Document automated workflows control points exceptions and maintenance requirements.

Audit Coordination and Repository Support

• Coordinate responses to external information security audits SOC 2-related requests technology/security assessments and ad hoc third-party auditor inquiries.
• Support audit requests for Corporate IT shared services and remote Milliman offices.
• Maintain secure audit repositories and ensure timely evidence delivery and closure.
• Coordinate responses across Practices when common clients or shared audit requirements arise.

Vendor Risk Management

• Support the Vendor Risk Management program including vendor identification risk assessments documentation review and reporting.
• Maintain visibility into critical vendors and monitor key risk indicators.
• Escalate vendor risks control gaps or changes in exposure to appropriate stakeholders or risk committees.
• Automate vendor intake reassessment reminders evidence collection risk scoring and reporting where feasible.

Security Awareness and Compliance Support

• Administer and report on information security awareness training compliance for employees and contractors.
• Maintain metrics dashboards reminders escalations and evidence of completion.
• Identify trends overdue training and opportunities for targeted awareness improvement.

SKILLS & QUALIFICATIONS REQUIRED:

• The ideal candidate must have 610 years of experience in information security risk management audit compliance GRC or related IT roles.
• The ideal candidate must have hands-on security audit or assessment experience preferably with a consultancy professional services finance insurance or similar organization.
• The ideal candidate must have experience with ISO/IEC 27000 series NIST Cybersecurity Framework HITRUST CSF HIPAA SOC 2 and related security/control frameworks.
• The ideal candidate must have experience with security tools and technologies such as SIEM VPN TCP/IP vulnerability scanning tools such as Qualys Active Directory proxy firewall IDS/IPS routers/switches and open-source information collection.
• Must have previous experience developing dashboards metrics KRIs/KPIs executive reports and remediation tracking.
• Must have advanced proficiency with Microsoft Word Excel OneNote PowerPoint and similar productivity tools.
• Must have strong understanding of security principles audit practices policies guidelines compliance and risk management.
• Must have strong technical knowledge of enterprise systems and security areas including networking operating systems identity and access management secure SDLC and cloud technologies such as Azure or AWS.
• Must have the ability to interpret security data identify compliance issues and translate complex technical topics into clear business language.
• Must have excellent project management skills including the ability to prioritize and manage complex work independently.
• Must have strong communication presentation problem-solving and stakeholder management skills.
• Must have the ability to lead influence and collaborate with information security teams technical partners business leaders Legal Compliance auditors and senior management.
• Must have the ability to work effectively in a globally distributed organization and understand international information security regulations.
• Must have willingness to travel occasionally.

SKILLS & QUALIFICATIONS PREFERRED:

• Bachelors or Masters degree in Computer Science Engineering Information Security or related field.
• CISSP CISA CRISC or equivalent certification.
• Experience with automation workflow creation AI-enabled tools or GRC/reporting platforms.

LOCATION:

• This is a remote role. The expected application deadline for this job is October 29 2026

COMPENSATION:

The overall range for this role is $95574 - $181228.

For candidates residing in:

• Alaska California Connecticut Illinois Maryland Massachusetts New Jersey New York City Pennsylvania Virginia Washington or the District of Columbia the range is $109910 - $181228.

• All other locations the range is $95574 - $157590.

A combination of factors will be considered including but not limited to education relevant work experience qualifications skills certifications etc.â

BENEFITS:

We offer a comprehensive benefits package designed to support employees health financial security and well-being. Benefits include:

• Medical Dental and Vision Coverage for employees dependents and domestic partners.

• Employee Assistance Program (EAP) Confidential support for personal and work-related challenges.

• 401(k) Plan Includes a company matching program and profit-sharing contributions.

• Discretionary Bonus Program Recognizing employee contributions.

• Flexible Spending Accounts (FSA) Pre-tax savings for dependent care transportation and eligible medical expenses.

• Paid Time Off (PTO) Begins accruing on the first day of work. Full-time employees accrue 15 days per year and employees working less than full-time accrue PTO on a prorated basis.

• Holidays A minimum of 10 paid holidays per year.

• Family Building Benefits Includes adoption and fertility assistance.

• Paid Parental Leave 11 weeks of paid leave for employees who meet eligibility criteria.

• Life Insurance & AD&D 100% of premiums covered by Milliman.

• Short-Term and Long-Term Disability Fully paid by Milliman.

ABOUT MILLIMAN:

Independent for over 77 years Milliman delivers market-leading services and solutions to clients worldwide. Today we are helping companies take on some of the worlds most critical and complex issues including retirement funding and healthcare financing risk management and regulatory compliance data analytics and business transformation.

Through a team of professionals ranging from actuaries to clinicians technology specialists to plan administrators we offer unparalleled expertise in employee benefits investment consulting healthcare life insurance and financial services and property and casualty insurance.

EQUAL OPPORTUNITY:

All qualified applicants will receive consideration for employment without regard to race color religion sex sexual orientation national origin disability or status as a protected veteran.

#LI-MP1 #LI-REMOTE

Required Experience:

IC