Title: GRC Senior Compliance Analyst – Continuous Compliance Framework
Location: Seattle, WA
VISA:
Tax Terms: W2/1099
EXP: 8+ YEARS
Required Qualifications
Experience
8+years of regulatory compliance experience with demonstrated ownership of cross-functional compliance initiatives.
Direct experience building and managing Continuous Compliance Framework (CCF) or Common Control Framework programs.
Experience leveraging AI and automation enhance CCF and control testing effectiveness and with AI/ML-assisted compliance or security monitoring tools, including designing prompts, workflows, or integrations that support control testing at scale.
Hands-on experience configuring compliance programs within GRC tools and platforms.
Experience working with stakeholders to define control language, RACI, and testing cadence.
Demonstrated experience developing KPIs and KRIs for compliance programs.
Familiarity with PCI DSS sufficient to support assessments and control testing activities.
Experience partnering with engineering or security teams to design or implement automated or AI-assisted control testing and evidence collection.
Proven ability to align compliance operations with strategic business objectives.
Education
Bachelor's or Master's degree in Information Technology, Computer Science, Cybersecurity, or related field, or equivalent work experience.
Technical Knowledge
Deep knowledge about multiple regulatory frameworks (CIS, NIST, SOX, HIPAA, CCPA, PCI DSS v4.x) and their control implications.
Experience testing technical controls and documenting evidence to support audits.
Understanding of enterprise compliance architecture and integrated control frameworks.
Familiarity with GRC tool configuration and workflow design.
Working knowledge of AI/automation tools applicable to compliance testing and evidence collection (e.g., automated evidence pulls, LLM-assisted evidence review, anomaly detection for control exceptions).
Skills
Strong control framework design and documentation capabilities.
Excellent stakeholder engagement and facilitation skills; able to drive consensus across technical and non-technical audiences.
Ability to develop and communicate KPIs/KRIs and compliance metrics to leadership.
Strong written and verbal communication skills, including experience presenting to senior leadership.
Self-directed and results-oriented; able to operate with autonomy, manage competing priorities, and drive programs to completion.
Collaborative mindset with the ability to work effectively across the GRC triad (risk, governance, compliance).
Comfort identifying where automation adds real value versus where human judgment is still required.
Preferred Qualifications
Certifications
Professional certifications preferred: CISA, CRISC, CIPP, CIPM, or equivalent.
PCI ISA, QSA, or other PCI-related certifications a plus.
Additional Experience
Experience with GRC platform implementation and administration.
Background in regulatory consulting or internal/external audit.
Experience leading enterprise-wide compliance transformation initiatives.
Proficiency in compliance automation, scripting, or security tooling.
