IT Risk & Compliance Analyst

• 
  
• Serve as a primary contributor to NORC's FedRAMP Continuous Monitoring Program, coordinating recurring activities required to maintain FedRAMP authorization.
• 
  
• Coordinate monthly, quarterly, annual, and ongoing FedRAMP Continuous Monitoring activities, including evidence collection, security control assessments, vulnerability management, POA&M management, metrics reporting, and security documentation updates.
• 
  
• Monitor the effectiveness of administrative, technical, and operational security controls across cloud and enterprise environments.
• 
  
• Partner with engineering, cloud, infrastructure, and operations teams to validate security controls, resolve compliance findings, and improve overall security posture.
• 
  
• Track security findings, vulnerabilities, and remediation efforts to ensure compliance with FedRAMP and other applicable security requirements.
• 
  
• Develop, review, validate, and maintain security documentation, including policies, standards, procedures, System Security Plans (SSPs), control implementation statements, and supporting compliance evidence.
• 
  
• Support internal and external audits by coordinating evidence requests, responding to assessor questions, and managing remediation activities.
• 
  
• Assist in developing compliance dashboards, metrics, and executive reporting that measure security posture, control effectiveness, and continuous monitoring performance.
• 
  
• Support governance and compliance initiatives across NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and customer-specific requirements.
• 
  
• Identify opportunities to improve compliance processes through automation, standardization, and continuous improvement.
• 
  
• Provide guidance to technical and business teams regarding security requirements, compliance obligations, and cybersecurity best practices.
• 
  
• Support Authorization to Operate (ATO) activities, annual assessments, and significant system changes as needed.
• 
  

Education & Certifications

• 
  
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent professional experience).
• 
  
• CAP, CGRC, CISSP, CISM, CISA or other cybersecurity certification preferred.
• 
  

1. FedRAMP Continuous Monitoring & Compliance (Primary Focus)

• 
  
• Minimum of two years of experience supporting cybersecurity, governance, risk, or compliance programs.
• 
  
• Experience supporting or maintaining a FedRAMP Authorized or FedRAMP Ready cloud environment is strongly preferred.
• 
  
• Knowledge of FedRAMP Continuous Monitoring requirements, including monthly, quarterly, annual, and significant change activities.
• 
  
• Experience coordinating evidence collection, security control assessments, vulnerability management, remediation tracking, POA&M management, and compliance reporting.
• 
  
• Experience monitoring security control effectiveness and partnering with technical teams to resolve compliance findings.
• 
  
• Experience supporting internal or external assessments and audit activities.
• 
  
• Familiarity with FedRAMP templates, documentation, assessment processes, and security reporting.
• 
  
• Familiarity with vulnerability management platforms, cloud security technologies, configuration compliance tools, endpoint security, and security monitoring solutions.
• 
  

2. Security Governance & Compliance

• 
  
• Strong understanding of cybersecurity governance principles and security compliance frameworks including NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and related industry standards.
• 
  
• Experience developing, reviewing, or maintaining security documentation including policies, standards, procedures, security plans, control documentation, and compliance evidence.
• 
  
• Experience supporting governance processes that improve compliance consistency, audit readiness, and operational maturity.
• 
  
• Experience using Governance, Risk, and Compliance (GRC) platforms such as CSAM, ServiceNow GRC, Archer, or similar solutions.
• 
  
• Experience supporting internal and external audits and working with customers, assessors, auditors, or Third-Party Assessment Organizations (3PAOs) is preferred.
• 
  

3. Risk Management

• 
  
• Experience conducting or supporting security risk assessments, security impact analyses, and control gap assessments.
• 
  
• Ability to identify security risks, assess business impact, and recommend practical remediation strategies.
• 
  
• Experience reviewing vulnerability findings and supporting remediation activities.
• 
  
• Understanding of enterprise risk management methodologies and cybersecurity risk management principles.
• 
  

4. Communication & Collaboration

• 
  
• Strong written and verbal communication skills.
• 
  
• Ability to communicate technical security concepts to both technical and non-technical audiences.
• 
  
• Experience collaborating with engineering, infrastructure, cloud operations, software development, business stakeholders, and leadership teams.
• 
  
• Strong organizational skills with the ability to manage multiple priorities in a fast-paced, highly regulated environment.
• 
  
• Experience coordinating cross-functional initiatives and driving remediation efforts to completion.
• 
  

5. Authorization to Operate (ATO) Support

• 
  
• Familiarity with the Authorization to Operate (ATO) process, NIST Risk Management Framework (RMF), FISMA, and FedRAMP authorization processes.
• 
  
• Experience assisting with System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), or related authorization documentation.
• 
  
• Experience supporting annual assessments, ongoing authorization activities, or significant system changes is preferred.
• 
  

NORC at the University of Chicago is an objective, non-partisan research institution that delivers reliable data and rigorous analysis to guide critical programmatic, business, and policy decisions. Since 1941, our teams have conducted groundbreaking studies, created and applied innovative methods and tools, and advanced principles of scientific integrity and collaboration. Today, government, corporate, and nonprofit clients around the world partner with us to transform increasingly complex information into useful knowledge.

For over 80 years, NORC has evolved in many ways, moving the needle with research methods, technical applications and groundbreaking research findings. But our tradition of excellence, passion for innovation, and commitment to collegiality have remained constant components of who we are as a brand, and who each of us is as a member of the NORC team. With world-class benefits, a business casual environment, and an emphasis on continuous learning, NORC is a place where people join for the stellar research and analysis work for which we’re known, and stay for the relationships they form with their colleagues who take pride in the impact their work is making on a global scale.

NORC is an equal opportunity employer. NORC evaluates qualified applicants without regard to race, color, religion, sex, gender, national origin, disability, status as a protected veteran, sexual orientation, and other legally protected characteristics.