IT Risk & Compliance Analyst

NORC at the University of Chicago is seeking an IT Risk & Compliance Analyst to join our DSS Security & Compliance team. This role is primarily responsible for supporting NORC's FedRAMP Continuous Monitoring Program, ensuring the ongoing effectiveness of security controls and maintaining compliance with FedRAMP requirements.

Working closely with engineering, cloud operations, infrastructure, development, and business teams, the analyst will help assess security control effectiveness, coordinate compliance activities, collect and validate evidence, track remediation efforts, and support ongoing audit readiness. In addition to FedRAMP, the role supports NORC's enterprise governance, risk, and compliance (GRC) program across NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and customer-specific security requirements.

The successful candidate will contribute to the continued maturity of NORC's security compliance program by improving continuous monitoring processes, strengthening governance practices, developing compliance metrics, and identifying opportunities to automate and streamline compliance activities.

Citizenship: U.S. Citizenship required due to federal project requirements.

NORC's Digital Services & Solutions (DSS) organization provides enterprise technology services that enable research, innovation, and client success. The Security & Compliance team partners across the organization to strengthen cybersecurity, reduce organizational risk, and maintain compliance with government, client, and industry security requirements.

• Serve as a primary contributor to NORC's FedRAMP Continuous Monitoring Program, coordinating recurring activities required to maintain FedRAMP authorization.
• Coordinate monthly, quarterly, annual, and ongoing FedRAMP Continuous Monitoring activities, including evidence collection, security control assessments, vulnerability management, POA&M management, metrics reporting, and security documentation updates.
• Monitor the effectiveness of administrative, technical, and operational security controls across cloud and enterprise environments.
• Partner with engineering, cloud, infrastructure, and operations teams to validate security controls, resolve compliance findings, and improve overall security posture.
• Track security findings, vulnerabilities, and remediation efforts to ensure compliance with FedRAMP and other applicable security requirements.
• Develop, review, validate, and maintain security documentation, including policies, standards, procedures, System Security Plans (SSPs), control implementation statements, and supporting compliance evidence.
• Support internal and external audits by coordinating evidence requests, responding to assessor questions, and managing remediation activities.
• Assist in developing compliance dashboards, metrics, and executive reporting that measure security posture, control effectiveness, and continuous monitoring performance.
• Support governance and compliance initiatives across NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and customer-specific requirements.
• Identify opportunities to improve compliance processes through automation, standardization, and continuous improvement.
• Provide guidance to technical and business teams regarding security requirements, compliance obligations, and cybersecurity best practices.
• Support Authorization to Operate (ATO) activities, annual assessments, and significant system changes as needed.

Education & Certifications

• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field (or equivalent professional experience).
• CAP, CGRC, CISSP, CISM, CISA or other cybersecurity certification preferred.

1. FedRAMP Continuous Monitoring & Compliance (Primary Focus)

• Minimum of two years of experience supporting cybersecurity, governance, risk, or compliance programs.
• Experience supporting or maintaining a FedRAMP Authorized or FedRAMP Ready cloud environment is strongly preferred.
• Knowledge of FedRAMP Continuous Monitoring requirements, including monthly, quarterly, annual, and significant change activities.
• Experience coordinating evidence collection, security control assessments, vulnerability management, remediation tracking, POA&M management, and compliance reporting.
• Experience monitoring security control effectiveness and partnering with technical teams to resolve compliance findings.
• Experience supporting internal or external assessments and audit activities.
• Familiarity with FedRAMP templates, documentation, assessment processes, and security reporting.
• Familiarity with vulnerability management platforms, cloud security technologies, configuration compliance tools, endpoint security, and security monitoring solutions.

2. Security Governance & Compliance

• Strong understanding of cybersecurity governance principles and security compliance frameworks including NIST SP 800-53 Rev. 5, CMMC, ISO 27001, SOC 2, HIPAA, and related industry standards.
• Experience developing, reviewing, or maintaining security documentation including policies, standards, procedures, security plans, control documentation, and compliance evidence.
• Experience supporting governance processes that improve compliance consistency, audit readiness, and operational maturity.
• Experience using Governance, Risk, and Compliance (GRC) platforms such as CSAM, ServiceNow GRC, Archer, or similar solutions.
• Experience supporting internal and external audits and working with customers, assessors, auditors, or Third-Party Assessment Organizations (3PAOs) is preferred.

3. Risk Management

• Experience conducting or supporting security risk assessments, security impact analyses, and control gap assessments.
• Ability to identify security risks, assess business impact, and recommend practical remediation strategies.
• Experience reviewing vulnerability findings and supporting remediation activities.
• Understanding of enterprise risk management methodologies and cybersecurity risk management principles.

4. Communication & Collaboration

• Strong written and verbal communication skills.
• Ability to communicate technical security concepts to both technical and non-technical audiences.
• Experience collaborating with engineering, infrastructure, cloud operations, software development, business stakeholders, and leadership teams.
• Strong organizational skills with the ability to manage multiple priorities in a fast-paced, highly regulated environment.
• Experience coordinating cross-functional initiatives and driving remediation efforts to completion.

5. Authorization to Operate (ATO) Support

• Familiarity with the Authorization to Operate (ATO) process, NIST Risk Management Framework (RMF), FISMA, and FedRAMP authorization processes.
• Experience assisting with System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), or related authorization documentation.
• Experience supporting annual assessments, ongoing authorization activities, or significant system changes is preferred.

The pay range for this position is $77,000 – $95,000.

This position is classified as regular. Regular staff are eligible for NORC’s comprehensive benefits program. Benefits include, but are not limited to:  

• Generously subsidized health insurance, effective on the first day of employment 

• Dental and vision insurance  

• A defined contribution retirement program, along with a separate voluntary 403(b) retirement program  

• Group life insurance, long-term and short-term disability insurance 

• Benefits that promote work/life balance, including generous paid time off, holidays; paid parental leave, bereavement leave, tuition assistance, and an Employee Assistance Program (EAP). 

NORC is committed to equity and transparency in its pay practices. We publish salary ranges and benefit information for every job. The listed hiring range reflects what we, in good faith, expect to pay at the time of posting, though actual compensation may vary and may be adjusted over time. A candidate’s placement within the range depends on factors such as competencies, education, qualifications, experience, skills, performance, and organizational needs.

NORC at the University of Chicago is an objective, non-partisan research institution that delivers reliable data and rigorous analysis to guide critical programmatic, business, and policy decisions. Since 1941, our teams have conducted groundbreaking studies, created and applied innovative methods and tools, and advanced principles of scientific integrity and collaboration. Today, government, corporate, and nonprofit clients around the world partner with us to transform increasingly complex information into useful knowledge.

For over 80 years, NORC has evolved in many ways, moving the needle with research methods, technical applications and groundbreaking research findings. But our tradition of excellence, passion for innovation, and commitment to collegiality have remained constant components of who we are as a brand, and who each of us is as a member of the NORC team. With world-class benefits, a business casual environment, and an emphasis on continuous learning, NORC is a place where people join for the stellar research and analysis work for which we’re known, and stay for the relationships they form with their colleagues who take pride in the impact their work is making on a global scale.

NORC is an equal opportunity employer. NORC evaluates qualified applicants without regard to race, color, religion, sex, gender, national origin, disability, status as a protected veteran, sexual orientation, and other legally protected characteristics.