About Nexcess

Nexcess provides specialty cloud solutions for organizations where performance and compliance have to coexist. We serve businesses worldwide, from agencies scaling client sites to enterprises running mission-critical operations. We've built our reputation on deep technical expertise and genuine partnership with every client we work with. Behind every environment we manage is a team of people who take the craft seriously and keep showing up when it matters.

EXPECTED COMPENSATION RANGE: $42K-$45K
Overview

The IT Compliance Analyst supports the organization’s security and compliance program through audit coordination, technical evidence review, control testing support, and remediation tracking. This role works with technical and business teams to demonstrate that controls are operating effectively, maintain reliable compliance records, and identify gaps before they become audit findings. The analyst evaluates what evidence demonstrates rather than simply collecting and organizing submissions.

Responsibilities

Audit Coordination and Readiness

• Coordinate assigned activities supporting SOC 1, SOC 2, SOC 3, HIPAA, GDPR, and PCI DSS audits and assessments, as applicable, from preparation through evidence submission and finding closure.
• Serve as a day-to-day contact for auditor requests and follow-up questions, escalating interpretation, policy, and risk decisions to the appropriate owners.
• Manage evidence trackers, control mappings, recurring compliance activities, and audit deadlines.
• Coordinate evidence requests across technical and business functions, communicating requirements, ownership, and timelines clearly.

Technical Evidence Review and Control Testing

• Gather, review, organize, and validate evidence for relevance, completeness, accuracy, and alignment with the control and review period.
• Evaluate technical evidence, including vulnerability scans, logging reports, access records, configuration data, change records, tickets, and system reports.
• Assist with control testing by distinguishing documented requirements, control design, and evidence that a control operated effectively.
• Identify evidence that does not adequately demonstrate the control being tested and work with control owners to resolve gaps or obtain clarification.
• Translate compliance requirements into actionable evidence requests while engaging technical owners for engineering decisions and implementation.

Findings and Recurring Control Follow-Through

• Track findings, exceptions, remediation actions, accountable owners, and deadlines through documented closure.
• Review remediation evidence for completeness and alignment with the identified issue, escalating unresolved questions to the appropriate reviewers.
• Identify missed recurring activities, outdated evidence, documentation gaps, and approaching deadlines.
• Follow up consistently with stakeholders and escalate delays or unresolved gaps that could affect audit readiness.

Documentation and Compliance Records

• Maintain policies, procedures, control narratives, diagrams, evidence guides, and supporting audit documentation in collaboration with responsible owners.
• Maintain a traceable record of requests, responses, exceptions, remediation activity, and approvals.
• Keep compliance records organized, current, and accessible to authorized stakeholders.
• Recommend improvements to evidence quality, documentation consistency, and audit coordination practices.

Additional Expectations

• Demonstrates and promotes the company's Impact Behaviors in all interactions and decision-making.
• • Design
  • Ownership
  • First Team
  • Performance
• Maintains a professional, collaborative, and client-focused approach while supporting team and organizational objectives.
• Performs other duties, responsibilities, and special projects as assigned to meet business needs.

Qualifications

Required

• Working knowledge of one or more relevant compliance frameworks or requirements, such as SOC, HIPAA, GDPR, or PCI DSS.
• Ability to interpret control requirements and determine what evidence reasonably demonstrates control design and operation.
• Foundational understanding of Linux and Windows systems, networking, firewalls, access controls, authentication and MFA, vulnerability management, patching, logging, backups, retention, encryption, change management, incident response, and business continuity.
• Ability to interpret technical records and explain what they demonstrate, including the relevance of terms such as syslog, CVE, subnet, TLS, root, ACL, and service account.
• Ability to manage substantial evidence sets, simultaneous auditor requests, and recurring compliance deadlines.
• Comfort working with ticketing systems, documentation platforms, spreadsheets, dashboards, and security or compliance tools.
• Strong written communication, documentation, organization, and follow-through.
• Sound judgment, attention to detail, curiosity, and professional persistence when resolving incomplete or unclear submissions.

Preferred

• Familiarity with multiple relevant compliance frameworks.
• Experience supporting audits or assessments in a technology or infrastructure environment.
• Experience improving evidence guidance, control documentation, or remediation tracking practices.

Key Performance Indicators

• Quality, completeness, and relevance of audit evidence.
• Timely completion of evidence requests and recurring compliance activities.
• Effective tracking and escalation of findings and remediation.
• Accuracy, currency, and traceability of compliance documentation.
• Clear coordination with auditors, control owners, and technical teams.

Work Environment

• While performing the essential duties of this job, the individual is regularly required to speak and hear
• While performing the essential duties of this job, the individual is regularly required to use hands for keyboarding, gross manipulation, and fine manipulation
• Works at a desk and computer screen for extended periods of time
• Works in a traditional climate controlled office environment or from home
• Works in a highly stressful environment dealing with a wide variety of challenges, deadlines and diverse employee population

Disclaimer

#LI-REMOTE