Top Compliance Analyst Jobs in Boston, MA

Own hardware certification and cybersecurity compliance for connected vehicle devices and OEM partnerships. Coordinate audits, translate ISO 21434 and other requirements into engineering controls, support threat modeling and firmware analysis, manage FirstNet certification, identify compliance gaps, automate evidence gathering, and communicate security posture and risk to engineering teams, customers, partners, and auditors.

Support day-to-day GRC operations: assess third-party vendors, maintain vendor risk register, track remediation and control evidence, assist with internal control testing and audits (SOC 2, ISO 27001, PCI-DSS), maintain policies, prepare reporting, and contribute to process improvements.

Lead governance, risk, and compliance activities for AI/ML systems, LLM integrations, AI agents, and related vendors. Conduct AI risk and third-party assessments, map controls to frameworks, manage remediation, support audits, develop AI-specific policies, report risk metrics, monitor regulatory developments, and coordinate incident governance with Legal, Security, Product, and Engineering teams.

Own technical compliance domains and lead audit and certification activities across SOC 2, ISO 27001, PCI DSS, SOX ITGC, NIST, and related frameworks. Coordinate evidence collection, control validation, remediation, and external auditor responses. Translate requirements into technical controls and scalable workflows, identify risks and gaps, report compliance metrics, and improve governance, risk, and compliance tooling through automation and repeatable processes.

Leads CarGurus’ cybersecurity governance, risk, and compliance program, including cyber risk management, SOC 2 Type II, SOX ITGCs, security policies, AI governance, third-party risk, customer trust, privacy compliance, executive reporting, and GRC process automation. Partners with Engineering, Product, IT, Legal, Privacy, Internal Audit, and Security Operations to improve security controls and manage organizational cyber risk.

Conduct trade practice surveillance, support customer onboarding, prepare CFTC regulatory filings, maintain exchange policies, investigate potential violations, monitor market participation and underlying industry news, and provide rotational coverage during live market hours.

Support governance, risk, and compliance by managing third-party risk, customer security assurance, cyber risk, SOX ITGCs, and security governance. Partner with security, engineering, legal, audit, privacy, finance and procurement to build scalable processes, improve audit readiness, and automate security workflows.

Supports investment teams by monitoring transactions and holdings for compliance with client guidelines and regulatory requirements. Reviews investment management agreements, evaluates client guidelines, maintains the Sentinel monitoring system, provides real-time pre-trade support, resolves post-trade exceptions, and collaborates with relationship, product management, and portfolio management teams.

Monitors quality management systems and business processes, produces operational reports, analyzes data, maps processes, and supports productivity improvements. Ensures GDP compliance for healthcare logistics, including corrective actions, risk assessments, cold-chain transportation, document control, training, audits, recalls, and customer requirements. Provides quality and technical training, maintains compliance records, supports regulatory inspections, and develops AI-enabled solutions.

Conduct KYC reviews, restricted-party screening, export-control and sanctions compliance reviews, sales opportunity assessments, and end-user due diligence. Maintain compliance records, databases, reports, dashboards, and authorization tracking. Review transactions under EAR and ITAR requirements, identify risks, resolve screening matches, support audits and training, and collaborate with Legal, Sales Operations, Finance, Procurement, and other teams while escalating higher-risk matters.

Manage SOC 1, SOC 2, and ISO 27001 compliance programs, including internal and external audits, control enforcement, corrective actions, and policy updates. Monitor security alerts, support incident investigations, coordinate penetration testing, and administer password and phishing management systems. Lead security awareness initiatives, advise stakeholders, collaborate with Legal on encryption regulations, and drive continuous improvements to the organization’s information security posture.

Investigates escalated and complex sales and marketing compliance cases, recommends corrective actions, drafts policies and investigative guidance, presents findings, mentors analysts, conducts quality reviews, identifies compliance trends, and partners with Sales, Legal, Operations, and Technology to improve workflows. The role focuses on Medicare Advantage compliance, agent and agency investigations, audits, remediation, and process improvement.

Reviews labor and wage compliance for public works and construction projects, including certified payroll, prevailing wage, apprenticeship, subcontractor documentation, payment records, and closeout files. Tracks deficiencies, coordinates corrections, maintains audit-ready records, validates data, supports reporting and audits, trains stakeholders, and recommends process improvements. Collaborates with construction operations, project management, accounting, procurement, contractors, subcontractors, agencies, and legal teams.

Serve as the compliance SME for HSA, FSA, and HRA products: review marketing and customer content, lead compliance risk assessments (including AI tools), advise product and ops teams on transaction and regulatory issues, monitor regulatory changes, support escalations and audits, and recommend controls and remediation for identified risks.

Supports international trade compliance programs, including post-entry and post-shipment reviews, recordkeeping, restricted-party screening, audit defense, customs broker issue resolution, regulatory analysis, and compliance project monitoring. The role requires expertise in U.S. Customs procedures, HTS and ECCN classification, import/export regulations, free trade agreements, country of origin, Incoterms, commercial invoices, ERP systems, and business analytics.

Supports mortgage origination compliance through complaint investigations, regulatory and investor examinations, risk-based monitoring, transactional testing, regulatory research, root cause analysis, reporting, and remediation. Independently manages multiple compliance matters, develops testing methodologies and monitoring materials, communicates findings to regulators and leadership, and recommends improvements to compliance controls and the Compliance Management System.

Performs cybersecurity risk assessments, compliance reviews, audits, and RMF/ATO support for federal systems. Identifies vulnerabilities, control gaps, and compliance deficiencies; develops mitigation strategies, remediation reports, risk analyses, and traceability matrices. Coordinates with government stakeholders, auditors, system owners, engineers, and vendors. Maintains cybersecurity policies, evidence, findings, dashboards, and risk records while monitoring remediation and evolving federal requirements. The role may include occasional onsite visits and support for third-party and supply-chain risk management.

Lead Horizon3’s federal compliance program for DoW IL4 and IL5 AWS offerings. Manage FedRAMP and NIST SP 800-53 frameworks, authorization assessments, System Security Plans, continuous monitoring, audits, risk assessments, policies, training, vendor questionnaires, and external auditor relationships. Advise engineering teams on translating federal requirements into cloud-native technical controls and participate in compliance-related incident response. The role is fully remote, requires U.S. citizenship and eligibility for a government security clearance, and involves up to 5% travel.

Build and scale compliance processes for Lemonade’s P&C insurance products across Car, Home, Renters, and Pet lines. Develop policies, provide regulatory guidance to leadership, partner with Insurance Operations and Product, manage compliance projects, and improve processes through AI and automation while handling multiple priorities and deadlines.

Supports customs, import/export, RMA, procurement, shipping, and customer due diligence workflows. Reviews trade documentation, assists with HTS classification and country-of-origin records, conducts restricted-party screening, evaluates export-control facts and red flags, and supports export license applications. Coordinates with brokers, freight forwarders, logistics, procurement, supply chain, sales, and internal stakeholders while maintaining compliance records and escalating issues.

Supports IT security and compliance programs, including HITRUST, HIPAA, and SOC 2 activities; policy documentation; risk assessments; audit evidence gathering; incident monitoring; and mitigation. Manages employee onboarding and offboarding, access controls, devices, SaaS tools, vendor reviews, GCP compliance documentation, incident response, and change management. Works independently with the CTO in a remote healthcare SaaS startup.

Own federal security and compliance workstreams for a FedRAMP High program, including control implementation, evidence collection, continuous monitoring, vulnerability remediation, risk tracking, audit readiness, authorization artifacts, and customer assurance. Partner with technical and business teams to close remediation items and support compliance-as-code using machine-readable artifacts, automation, validation, and document generation.

Supports IT governance, risk, privacy, and compliance programs by maintaining policies, coordinating audits, assessing technology and vendor risks, reviewing contracts, and tracking remediation. Manages privacy documentation including data inventories and processing records, evaluates AI solutions against relevant frameworks, audits access and IT assets, administers cybersecurity awareness training, and partners with Legal, Security, IT, People, and Procurement to embed compliance requirements in business initiatives.

Supports a broker-dealer compliance program by maintaining policies and procedures, assisting with representative registrations, conducting compliance testing, delivering regulatory training, monitoring regulatory developments, and responding to regulatory inquiries. The role requires broker-dealer compliance experience, familiarity with FINRA and investment adviser regulations, strong data analysis, organization, attention to detail, and communication skills.

Oversee secure configuration compliance across IT systems and infrastructure. Monitor configurations, identify policy violations, coordinate remediation with IT and security teams, develop compliance metrics and reports, and improve security configuration management processes. The role requires strong analytical, communication, organizational, and risk mitigation skills, along with knowledge of CIS, NIST, and ISO 27001 frameworks.