{"id":1440685,"url":"https://alion.io/job/ecmc-group-information-technology-risk-compliance-analyst","title":"Information Technology Risk & Compliance Analyst","company":{"id":1857870,"name":"ECMC Group","domain":"ecmcgroup.org","url":"https://alion.io/company/ecmcgroup","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Minneapolis, United States"],"countries":["US"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":90000,"max":100000,"currency":"USD","period":"year","gross":null,"usd_annual":100000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"HIPAA","optional":false},{"name":"Microsoft Office","optional":false},{"name":"SharePoint","optional":false}],"status":"live","first_seen_at":"2026-09-25T00:00:00Z","employer_posted_date":"2026-09-25","last_verified_at":"2026-10-30T02:00:56Z","board_verified":true,"closed_at":null,"days_open":35,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":35},"description":"ECMC Group is a nonprofit corporation focused on helping students succeed. Headquartered in Minneapolis, ECMC Group and its family of companies provide financial tools and services, as well as funding for innovative programs to help students achieve their academic and professional goals.\nJob Summary\nResponsible for planning, executing and reporting on complex IT compliance activities and related initiatives across information systems. Performs assigned portions of IT compliance programs, determining compliance with policies and procedures, monitoring, recommending corrective action, preparing findings, and assisting with remediation plans. Reviews and services should be performed in accordance with professional and department standards.\nEssential Duties and Responsibilities:\nLeads and performs complex IT compliance activities including planning, risk analysis, testing and reporting in accordance with professional and department standards.\nLeads vendor security risk assessments and reviews security and compliance provisions within vendor contracts in partnership with procurement and legal teams.\nIndependently engages management to assess processes, identify control weaknesses and discuss compliance observations and risks.\nSecures management ownership of findings and remediation plans and monitors remediation progress through completion.\nPrepares clear documentation and draft reports communicating results, risks and recommendations to improve information system controls and practices.\nPlans and executes IT compliance reviews and supports internal and external audits through evidence preparation and auditor coordination.\nContributes to enterprise risk assessments by identifying emerging risks, control gaps and improvement opportunities.\nProvides guidance and informal coaching to staff on compliance activities of low to medium complexity as assigned.\nAnticipates and manages stakeholder expectations while ensuring timely, consistent delivery of compliance services.\nCommunicates complex compliance concepts clearly to peers, leaders and business partners.\nPerforms other duties or responsibilities as assigned.\nRequired Qualifications:\nBachelor’s degree in computer information systems, information technology, legal studies, or related field or an additional 2 years of relevant experience in lieu of degree.\nUnderstanding of IT concepts such as identity and access management, threat and vulnerability management, data loss prevention, change management, data analytics, and software development lifecycle\n3+ years of experience in IT risk and compliance, IT governance, IT auditing or an IT related field\nExperience assessing vendor risk, performing security assessments, and reviewing contracts\nExperience working with procurement and legal teams\nExperience assessing security controls for AWS or cloud environments\nExperience developing and maintaining policies and/or information management frameworks\nExperience creating and assembling evidence for internal or external auditors\nAdvanced knowledge of Microsoft Office suite, including experience analyzing data using Excel and designing or managing SharePoint sites\nGeneral knowledge of security control concepts, principles, risk analysis, FISMA, PCI Compliance, HIPAA, Privacy, process improvement and techniques, including frameworks such as NIST, ISO2700, COSO and COBIT\nPreferred Qualifications:\nCertified Information Systems Auditor (CISA), Certified Internal Auditor (CIA) certifications preferred\nThe pay range for this position is $90,000-$100,000. Actual compensation may vary based on factors such as relevant experience, peer and market benchmarks, and geographic location.\nThis position is classified ashybrid Monday - Wednesday and requires attendance in Minneapolis, MN.\nTo perform this job successfully, an individual must be able to perform each essential duty satisfactorily. The requirements listed above are representative of the knowledge, skill, and/or ability required. Reasonable accommodations may be made to enable individuals with disabilities to perform the essential functions.\nECMC Group also provides a comprehensive benefits package:\nHealth & wellness benefits: Medical,dental, and vision insurance plan options, with a generous employer subsidy. Company paid life & disability insurance, pre-tax flexible spending accounts and robust wellness programs.\nFinancial benefits: Generous401(k) plan with a company match up to 6% and additional discretionary contribution potential, holiday time off, paid time off accrual starting at 20 days/year and commuter subsidy.\nEducation benefits: Tuition reimbursement up to $10,500/year for approved programs and student loan payment reimbursement up to $4,800/year. Up to $5,250 of qualifying education benefits can be reimbursed pre-tax.","description_format":"text","description_chars":4795,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"bachelor","optional":false},"security_clearance":false,"languages":[]},"benefits":["Vision insurance","Wellness"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Nonprofits & Foundations"],"lifecycle":[{"event":"open","at":"2026-09-29T04:47:27Z"}],"visa":[],"liveness":{"score":42,"band":"fade","label":"Fading","p_open":1,"p_active":0.764,"p_room":0.55,"age_days":35,"expected_fill_days":32,"reasons":["conf:3","win:tail"],"computed_at":"2026-10-30T05:48:23Z"},"pay":{"stated_usd_annual":100000,"is_top_pay":false},"html_url":"https://alion.io/job/ecmc-group-information-technology-risk-compliance-analyst","json_url":"https://alion.io/job/ecmc-group-information-technology-risk-compliance-analyst.json","meta":{"generated_at":"2026-10-30T09:21:13Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":13451,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-31T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1857870},"rest":"https://alion.io/mcp/rest/get_company?id=1857870"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fecmc-group-information-technology-risk-compliance-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fecmc-group-information-technology-risk-compliance-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fecmc-group-information-technology-risk-compliance-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/ecmc-group-information-technology-risk-compliance-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fecmc-group-information-technology-risk-compliance-analyst"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1440685}},{"tool":"search_jobs","arguments":{"company":"ecmcgroup.org","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1440685},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}