Governance & Compliance Analyst - Bozeman

Job Description

The Governance & Compliance Analyst is responsible for advancing the organization's security assurance, compliance, privacy, and resilience programs, with particular emphasis on business continuity and disaster recovery readiness and regulatory compliance support. This role coordinates continuity planning, business impact assessments, remediation tracking, audit readiness, customer security questionnaires, privacy and compliance evidence collection, policy and procedure support, and employee training. Working closely with security, technology, legal, sales, privacy, and business teams, the analyst helps ensure the organization meets contractual and regulatory obligations, demonstrates security maturity, protects sensitive information, and sustains critical operations during business interruptions.

The Information Security team focuses on the compliance of Zoot’s Information Security Program, which includes creating, enforcing, auditing, and promoting company policies, procedures, standards, audit framework and guidelines.

• Partner with security, technology, legal, sales, privacy, and business teams to ensure security, compliance, privacy, and resilience requirements are understood and supported.
• Communicate with internal stakeholders, clients, prospects, and third parties regarding security, compliance, privacy, and resilience requests and expectations.
• Prepare metrics, reports, and status updates related to program readiness, compliance progress, training completion, remediation efforts, and customer support activities
• Contribute to the continuous improvement of the organization's security assurance, compliance, privacy, and resilience capabilities.
• Maintain working knowledge of Zoot solutions, internal policies, and business practices.
• Compliance with and knowledge of Zoot’s Policies and Procedures, Code of Business Conduct, and Employee Agreement.
• Achieve a service-focused culture with emphasis on delivering on-time, high-quality products and services to internal customers.
• Other duties as assigned – it is understood that this list of major duties and responsibilities is not an all-inclusive list and that other duties and responsibilities, which may include helping others in the same or different departments, may be assigned by supervision.

• Support internal, client, and third‑party audits by gathering, analyzing, and communicating requested evidence, documentation, and responses.
• Respond to customer security questionnaires, due diligence requests, and requests for security, privacy, resilience, and compliance documentation.
• Serve as a point of contact for external compliance audits and for client and prospect questions related to compliance and assurance matters.
• Carry out regular audits and follow up on findings through corrective actions, policy updates, and additional training as needed.
• Track audit findings, gaps, and remediation items to closure and provide status updates to stakeholders.

• Develop, maintain, and revise compliance policies and procedures and support the day‑to‑day operation of the compliance program.
• Monitor regulatory, contractual, and policy requirements and partner with Legal, General Counsel, and other stakeholders to resolve complex compliance issues.
• Respond to potential violations of rules, regulations, policies, and procedures and help ensure concerns are appropriately evaluated, investigated, and resolved.
• Support privacy compliance activities related to data handling, control documentation, assessments, regulatory and contractual obligations, and alignment with company policies and procedures.
• Develop and deliver compliance training for new employees as well as ongoing training for employees and managers.
• Support implementation and review of compliance obligations associated with applicable consumer financial laws, regulations, contracts, and industry best practices.

• Maintain and help mature the organization’s business continuity, disaster recovery, and related resilience documentation, including plans, procedures, contact lists, and recovery dependencies.
• Facilitate business impact…