Governance, Risk and Compliance Analyst III; GRC Analyst III

Job Category: Information Technology

Requisition Number: GOVER
010801

• Posted :
  October 23, 2026
• Full-Time
• Remote

Showing 1 location

08-New York
New York, NY 10119, USA

NOTE:
Individual(s) must be legally authorized to work in the United States without the need for immigration support or sponsorship from Milliman now or in the future.

POSITION SUMMARY:

The Governance, Risk & Compliance Analyst (GRC Analyst III) is a senior level role within the Global Corporate Services Information Security team. This position supports Milliman Practices and the broader firm by managing GRC activities, internal security reviews, contract and questionnaire reviews, audit coordination, vendor risk management, security awareness reporting, automation, AI agent creation, and continuous compliance monitoring.

The role validates compliance with the Milliman Information Security Policy, identifies risks and control gaps, provides consultative guidance to improve security posture, and develops dashboards, workflows, and automated reporting to streamline GRC operations.

RESPONSIBILITIES: (in order of priority)

Contract, Questionnaire, and Document Review

• Serve as a key point of contact for information security contract terms, IS questionnaires, RFPs/RFQs, MSAs, BAAs, addenda, and related inquiries.
• Review legal agreements and client documentation to ensure consistency with the Milliman Information Security Policy and applicable privacy/security requirements.
• Collaborate regularly with Legal, Compliance, Information Security, and business teams.
• Track contract and inquiry status to ensure internal service-level agreements are met.
• Maintain approved response libraries, templates, and workflow routing for recurring inquiries.

GRC Dashboard, Reporting, and Continuous Compliance

• Create, maintain, and enhance GRC dashboards covering internal reviews, audit readiness, training compliance, vendor risk, KRIs/KPIs, remediation, and control effectiveness.
• Develop recurring compliance reports for leadership, risk committees, auditors, and Board-level reporting.
• Support continuous compliance monitoring through automated evidence collection, exception tracking, alerts, and escalation workflows.
• Monitor policy compliance, control gaps, overdue remediation, and risk trends.
• Support compliance enforcement through reporting, follow-up, escalation, and remediation tracking.

Automation, AI Agents, and Workflow Improvement

• Design, create, and maintain AI agents and automations to support GRC activities such as security questionnaire responses, contract review triage, control mapping, audit evidence collection, vendor intake, compliance reminders, and status reporting.
• Streamline GRC workflows for intake, review, approval, evidence collection, escalation, remediation, and reporting.
• Validate AI-generated and automated outputs for accuracy, consistency, and compliance with approved guidance.
• Document automated workflows, control points, exceptions, and maintenance requirements.

Audit Coordination and Repository Support

• Coordinate responses to external information security audits, SOC 2-related requests, technology/security assessments, and ad hoc third-party auditor inquiries.
• Support audit requests for Corporate IT shared services and remote Milliman offices.
• Maintain secure audit repositories and ensure timely evidence delivery and closure.
• Coordinate responses across Practices when common clients or shared audit requirements arise.
• Support the Vendor Risk Management program, including vendor identification, risk assessments, documentation review, and reporting.
• Maintain visibility into critical vendors and monitor key risk indicators.
• Escalate vendor risks, control gaps, or changes in…