Note: The job is a remote job and is open to candidates in USA. Carnival Cruise Line, part of Carnival Corporation, provides safe, fun, and memorable cruise vacations while promoting an ethical and compliant culture. The Principal Analyst, IT Compliance serves as a subject matter expert responsible for leading IT compliance assessments, audits, monitoring, reporting, policy development, risk mitigation, and vendor compliance activities. The role advises senior management, supports internal and external audits, and leads compliance initiatives involving SOX, PCI, GDPR, cybersecurity frameworks, and access controls.
Responsibilities
- Lead and oversee assessments conducted by more junior analysts, reviewing evidence demonstrating the organization’s compliance with applicable laws, regulations, and industry standards
- Interview stakeholders to ensure compliance requirements are met and understood
- Review policies, procedures, and controls to ensure alignment with requirements
- Decision maker in working with cross functional teams to resolve compliance issues
- Represent IT in communicating compliance related work product to internal and external stakeholders and executive leadership
- Function as a SME for IT Compliance
- Stay abreast of emerging technologies, industry trends, and best practices
- Research new tools, frameworks, and methodologies that can enhance solution designs and delivery
- Evaluate and recommend appropriate solutions
- Develop and communicate technology roadmaps
- Review and improve tools, methods, processes, and procedures
- Lead ongoing compliance activities, track regulatory changes, and prepare reports for management and regulatory agencies
- Document compliance findings, issues, and serve as the decision maker for remediation efforts
- Conduct impact assessments to determine the impact of regulatory changes and report findings to leadership
- Assess compliance-related risks and lead the development of risk mitigation strategies
- Stay abreast of regulatory changes and industry developments to ensure compliance programs remain current and effective
- Build processes that drive automation and continuous compliance monitoring
- Conduct internal assessments and reviews to evaluate the effectiveness of controls and identify areas for improvement
- Review access controls, data protection measures, and security configurations
- Lead the response to both Internal and External Audits and other stakeholder's findings and inquiries, preparing and presenting official documentation where appropriate
- Act as the top expert in compliance policies, standards, and procedures
- Provide training and awareness programs to educate analyst team and stakeholders about compliance requirements and best practices
- Takes the lead in developing, reviewing, and update IT policies, procedures, and standards to address compliance requirements
- Reviews and approves documents such as acceptable use policies and data retention policies plans
- Represents the department in communicating policies and procedures to stakeholders and executive leadership
- Provide oversight and decision making in vendor selection, assess the compliance of vendors and third-party service providers to ensure they meet all security and regulatory requirements
- Oversee audits of third-party service providers and lead the work to resolve vendor issues
- Performs other duties as assigned
Skills
- Bachelor's Degree in information technology, computer science, or related field or related equivalent work experience
- 7 years' experience:
- As an Auditor/assessor in a regulatory environment
- Conducting assessments specific to PCI and SOX
- Applying access controls and IAM principles
- Implementing and assessing segregation or separations of duties
- Working in a compliance role as part of a large Information Technology department
- Documenting and communicating regulatory requirements, standards, policies, procedures, and vulnerabilities related to compliance
- Leading critical compliance projects
- 5+ years experience:
- Participating in cross-functional technology teams
- Planning and managing large projects
- Auditor for IT systems
- CISA (Certified Information Systems Auditor) or CIA (Certified Internal Audit)
- Expert level knowledge of systems architecture and network applications and protocols, configuration, logging, monitoring, and administration to understand impacts on compliance
- Ability to support a multisite enterprise environment
- Recognized Strategic Authority in the field of regulatory and security standards and requirements including PCI, SOX and GDPR
- Expertise in Cybersecurity frameworks such as NIST CSF
- Ability to engage and manage compliance projects to a successful outcome
- Intermediate-to-advanced technical knowledge across cloud platforms (AWS, Azure, GCP), IAM/PAM systems, Operating Systems (Linux/Windows), Databases and DevOps/CI-CD pipelines to support control validation and risk
- Ability to develop dashboards, reports, etc. that can be consumed by executives
- Advanced skills in critical thinking, creative problem solving, and root cause analysis with the ability to lead teams through this process
- Flexibility to adjust to changing priorities and manage multiple deadlines
- Outstanding analytical and attention to detail with exceptional business acumen
- Ability to manage tight deadlines, prioritize workload and achieve exceptional results
- Ability to write and review comprehensive and concise technical reports and presentations to be consumed by non-technical individuals
- Ability to create PowerPoint presentations that are informative and engaging and deliver them to various audiences including executive management. Comfortable presenting to senior executives
- Exceptional communication, team building, conflict management, and organizational skills
- Excellent track record of working collaboratively with cross-functional teams to achieve common goals and drive exceptional results
- Proficiency in MS Office
- Proven ability to quickly learn and teach new technologies and concepts
- Demonstrated capability in managing organizational dynamics
- Must be able to remain in a stationary position at a desk and/or computer for extended periods of time
- Less than 25% non-shipboard travel likely
- If the search is extended past those areas, candidates must be located in one of the following U.S. states: FL, GA, TX and NC
- PMP (Project Management Professional)
- CISM (Certified Information Security Manager)
- CFSA (Certified Financial Systems Analyst)
- CITGCP (Certified IT General Controls Practitioner
- CSOXI (Certified Sarbanes Oxley Act Practitioner)
- PCIP (Payment Card Industry Professional)
- CISSP (Certified Information Systems Security Professional)
- 1+ year in the cruise and/or travel industry
Benefits
- All non-sales roles participate in an annual cash bonus program.
- Director and above roles may also be eligible to participate in Carnival’s discretionary equity incentive plan.
- Cost-effective medical, dental and vision plans
- Employee Assistance Program and other mental health resources
- Company paid term life insurance and disability coverage
- 401(k) plan that includes a company match
- Employee Stock Purchase plan
- 8 company-wide holidays, plus 2 additional floating holidays for full-time and part-time with benefits employees
- Full-time employees at the manager and below level start with 14 vacation days/year; director and above level start with 19 vacation days/year.
- All employees gain additional vacation time with further tenure.
- All full-time employees receive 80 hours of sick time each year.
- Complementary stand-by cruises, employee discounts on confirmed cruises, plus special rates for family and friends
- Personal and professional learning and development resources including tuition reimbursement
- This position is classified as “remote.” As a remote role, it allows employees to work full-time from their home.
- It may also require regular travel to Carnival headquarters in Miami, FL for in-office collaboration.
Company Overview