Title: Compliance Analyst 2
Location: Seattle, WA
VISA:
Tax Terms: W2/1099
EXP: 5+ YEARS
Governance, Risk & Compliance | Information Security
Job Summary
Client’s Governance, Risk & Compliance (GRC) team is looking for a Compliance Analyst to help build out three of our most active programs: the Continuous Compliance Framework (CCF), Financial Control Audit, and PCI DSS. All three are actively maturing, and you'll be right there building alongside us — standing up RACIs, shaping the KPIs/KRIs that show program health, and helping put governance structures in place that actually hold. This isn't a "maintain what already exists" role; it's a "help us build the thing" role.
Required Qualifications
• 5+ years of hands-on professional experience running PCI DSS assessments, along with CCF and/or SOX experience or equivalent.
• Working understanding of at least one relevant framework or standard (e.g., PCI DSS, NIST 800-30/CSF, ISO 27005, SOX, HIPAA) and the ability to apply it correctly to routine scenarios.
• Experience with, or strong aptitude for, hands-on technical control testing (e.g., firewall rule reviews, access reviews, log configuration checks) and gap analysis.
• Experience building or maintaining RACIs, or strong understanding of how to document control ownership and accountability.
• Interest in and aptitude for metrics — comfortable helping design or track KPIs/KRIs that reflect program health.
• Experience using AI and automation to make compliance work more effective — e.g., evidence pulls, LLM-assisted review — and the ability to evaluate what's actually a time-saver versus what still needs a human eye.
• Strong organizational skills — able to juggle evidence collection, testing, and documentation across two programs without dropping things.
• Clear written and verbal communication skills, including the ability to translate technical findings into business-friendly language.
• Ability to work with minimal supervision on established processes, while knowing when to escalate.
Preferred Qualifications
• Pursuing or holding an associate-level certification such as CISA, CRISC, ISO 27001 Implementer, CIPM, or CIPP.
• Experience with a GRC platform (e.g., ServiceNow, OnSpring, AuditBoard, Archer or similar) for tracking findings and evidence.
• Familiarity with cloud environments (AWS, Azure, or Google Cloud Platform) as they relate to compliance scope.
