Note: The job is a remote job and is open to candidates in USA. Allia Health Group is seeking a Compliance Analyst to support daily SOC 2 operations and maintain year-round audit readiness. The role coordinates evidence collection, control remediation, vendor and risk reviews, reporting, and the development of the company’s ISO 42001 and AI governance program.
Responsibilities
- Coordinate evidence collection, validation, and remediation across control owners; follow up on overdue or incomplete items
- Maintain audit readiness year-round rather than treating SOC 2 as an annual exercise
- Identify control gaps, exceptions, and deficiencies, and coordinate remediation with the responsible team
- Support SOC 2 Type 2 audit fieldwork and auditor requests
- Escalate overdue or material issues to the CCO and relevant IT/business leadership
- Operate and maintain Drata day to day, including API integrations and automated evidence sources
- Investigate and remediate failed automated tests and compliance exceptions
- Keep evidence complete, accurate, and correctly mapped to controls
- Look for ways to automate manual evidence collection and cut recurring effort
- Support building the AIMS: policies, procedures, controls, risk assessments, and supporting documentation
- Help build and maintain an inventory of AI systems, applications, and use cases
- Coordinate AI risk and impact assessments, control activities, and evidence collection
- Work with IT and business stakeholders to put AI governance requirements into practice
- Support future ISO 42001 readiness assessments and certification work
- Maintain the SaaS/technology inventory
- Support security and compliance reviews for new and existing vendors (SOC reports, questionnaires, certifications, contract requirements)
- Track vendor compliance gaps and remediation, and keep related evidence current for SOC 2 and applicable ISO 42001 requirements
- Maintain the risk register and coordinate periodic updates with risk owners
- Support information security, technology, third-party, and AI-related risk assessments
- Facilitate quarterly access reviews and track completion and remediation
- Escalate material or overdue risks to the CCO and appropriate leadership
- Organize and maintain documentation for SOC 2 and ISO 42001 assessments
- Coordinate responses to auditor and assessor requests, and maintain audit trails
- Track findings and corrective actions through closure
- Build monthly compliance and IT dashboards for leadership: MFA coverage, access review completion, onboarding/offboarding SLAs, evidence completion, remediation status, vendor reviews, and trends
- Surface upcoming deadlines, overdue items, and risks that need management attention
Skills
- 2–5 years in compliance, GRC, information security, IT audit, or risk management
- Working knowledge of SOC 2 and information security controls
- Experience with a GRC/continuous compliance platform (Drata, Vanta, Secureframe, or similar)
- Experience coordinating evidence collection and remediation across technical and business teams
- Familiarity with NIST, ISO 27001, or CIS Controls
- Strong organizational skills and comfort managing multiple stakeholders and deadlines
- Strong written and verbal communication
- Able to work independently, spot gaps, and drive issues to resolution
- Applicants must be legally authorized to work in the United States without the need for current or future sponsorship
- Experience supporting ISO 42001 or another AI management system
- Experience with AI governance, AI risk assessments, or emerging technology risk
- HIPAA or healthcare compliance experience, ideally in a technology or regulated environment
- ISO 27001 or other ISO management-system experience
- CISA, CISM, CRISC, Security+, ISO 27001, or ISO 42001 certification or training
Benefits
- Full benefits package including medical, vision, dental, 401(k) with company match, PTO, Flex days, holidays, and more!
Company Overview