Top Compliance Analyst Jobs in Boston, MA

Lead governance, risk, and compliance activities for AI/ML systems, LLM integrations, AI agents, and related vendors. Conduct AI risk and third-party assessments, map controls to frameworks, manage remediation, support audits, develop AI-specific policies, report risk metrics, monitor regulatory developments, and coordinate incident governance with Legal, Security, Product, and Engineering teams.

Own technical compliance domains and lead audit and certification activities across SOC 2, ISO 27001, PCI DSS, SOX ITGC, NIST, and related frameworks. Coordinate evidence collection, control validation, remediation, and external auditor responses. Translate requirements into technical controls and scalable workflows, identify risks and gaps, report compliance metrics, and improve governance, risk, and compliance tooling through automation and repeatable processes.

Leads CarGurus’ cybersecurity governance, risk, and compliance program, including cyber risk management, SOC 2 Type II, SOX ITGCs, security policies, AI governance, third-party risk, customer trust, privacy compliance, executive reporting, and GRC process automation. Partners with Engineering, Product, IT, Legal, Privacy, Internal Audit, and Security Operations to improve security controls and manage organizational cyber risk.

Support governance, risk, and compliance by managing third-party risk, customer security assurance, cyber risk, SOX ITGCs, and security governance. Partner with security, engineering, legal, audit, privacy, finance and procurement to build scalable processes, improve audit readiness, and automate security workflows.

Lead and enhance Circle's IT SOX compliance program by evaluating ITGCs, automated and IT-dependent controls, documenting SOX-ready materials, coordinating testing and remediations, liaising with IT, Security, Finance and auditors, and driving control design for system implementations and new product launches.

Lead Horizon3’s federal compliance program for DoW IL4 and IL5 AWS offerings. Manage FedRAMP and NIST SP 800-53 frameworks, authorization assessments, System Security Plans, continuous monitoring, audits, risk assessments, policies, training, vendor questionnaires, and external auditor relationships. Advise engineering teams on translating federal requirements into cloud-native technical controls and participate in compliance-related incident response. The role is fully remote, requires U.S. citizenship and eligibility for a government security clearance, and involves up to 5% travel.

Build and scale compliance processes for Lemonade’s P&C insurance products across Car, Home, Renters, and Pet lines. Develop policies, provide regulatory guidance to leadership, partner with Insurance Operations and Product, manage compliance projects, and improve processes through AI and automation while handling multiple priorities and deadlines.

Supports customs, import/export, RMA, procurement, shipping, and customer due diligence workflows. Reviews trade documentation, assists with HTS classification and country-of-origin records, conducts restricted-party screening, evaluates export-control facts and red flags, and supports export license applications. Coordinates with brokers, freight forwarders, logistics, procurement, supply chain, sales, and internal stakeholders while maintaining compliance records and escalating issues.

Supports IT security and compliance programs, including HITRUST, HIPAA, and SOC 2 activities; policy documentation; risk assessments; audit evidence gathering; incident monitoring; and mitigation. Manages employee onboarding and offboarding, access controls, devices, SaaS tools, vendor reviews, GCP compliance documentation, incident response, and change management. Works independently with the CTO in a remote healthcare SaaS startup.

Own federal security and compliance workstreams for a FedRAMP High program, including control implementation, evidence collection, continuous monitoring, vulnerability remediation, risk tracking, audit readiness, authorization artifacts, and customer assurance. Partner with technical and business teams to close remediation items and support compliance-as-code using machine-readable artifacts, automation, validation, and document generation.

Supports IT governance, risk, privacy, and compliance programs by maintaining policies, coordinating audits, assessing technology and vendor risks, reviewing contracts, and tracking remediation. Manages privacy documentation including data inventories and processing records, evaluates AI solutions against relevant frameworks, audits access and IT assets, administers cybersecurity awareness training, and partners with Legal, Security, IT, People, and Procurement to embed compliance requirements in business initiatives.

Supports a broker-dealer compliance program by maintaining policies and procedures, assisting with representative registrations, conducting compliance testing, delivering regulatory training, monitoring regulatory developments, and responding to regulatory inquiries. The role requires broker-dealer compliance experience, familiarity with FINRA and investment adviser regulations, strong data analysis, organization, attention to detail, and communication skills.

Conducts employee expense report audits, identifies compliance issues and fraud indicators, maintains internal control documentation and process maps, assesses control gaps, and supports internal and external audits. The role applies COSO, HIPAA, CMS, IRS, and internal control best practices while communicating findings and remediation recommendations to finance leadership and operational stakeholders.

Executes Liquidia’s IT compliance program across SOX, GxP, and 21 CFR Part 11 requirements. Manages IT audits, control evidence, corrective actions, third-party risk assessments, infrastructure qualification, validated systems documentation, cybersecurity framework alignment, AI governance records, and external auditor coordination. Partners with Quality, Procurement, Legal, auditors, and IT stakeholders to maintain policies, assess compliance impacts, support validation activities, and mature the cybersecurity governance roadmap.

Transform operational and financial data into actionable insights to support vaccine purchasing programs. Build dashboards and reports, monitor manufacturer contract compliance, analyze purchasing and enrollment trends, support revenue optimization and rebate/commission reporting, maintain Salesforce data integrity, and drive process improvement and automation across cross-functional teams.

Support Ethics & Compliance by performing compliance monitoring, quality assurance, internal investigations, third-party due diligence, contract compliance reviews, metrics/reporting, and documentation. Cross-train across audit, risk, and compliance functions and produce reports for senior leadership and the board.

Execute internal audits and SOX engagements across the global organization. Assess design and operating effectiveness of controls, identify findings and remediation plans, perform walkthroughs, review third-party arrangements, and support external audits and ad-hoc assignments.

Develop, implement, and maintain cybersecurity policies and data classification aligned with NIST CSF, FedRAMP High, IL5 and other standards; support ATO processes, manage compliance documentation and audits, train employees on security/privacy, and troubleshoot policy implementation for GovCloud environments.

Serve as the compliance SME for HSA, FSA, and HRA products: review marketing and customer content, lead compliance risk assessments (including AI tools), advise product and ops teams on transaction and regulatory issues, monitor regulatory changes, support escalations and audits, and recommend controls and remediation for identified risks.

The Data Privacy Compliance Analyst will support the development and implementation of data privacy programs, assist privacy operations, and ensure compliance with global privacy laws.

Classifies defense-industry parts and products under HTS and Schedule B, documents classification rationales, and supports import/export compliance. Applies rules of origin, customs requirements, ITAR, EAR, and other agency regulations. Coordinates with engineers and stakeholders, maintains compliance records, supports audits, post-entry reviews, FTZ activities, reporting, training, and special projects. Provides expert guidance on international trade compliance and helps improve operational efficiency.

Lead SOC 2 Type II compliance and audit activities, manage data privacy (GDPR, CCPA/CPRA, EU AI Act), run vendor risk lifecycle, respond to customer security questionnaires/RFPs, and collaborate with cross-functional teams to mature GRC and privacy programs across the organization.

Lead assessment and management of ITGCs and cloud security controls; support customer due diligence, contract reviews, and compliance questionnaires; partner with Security, Engineering, Product, and Legal; support external audits and certifications (SOC, ISO, FedRAMP); perform risk assessments, document controls, and drive remediation to maintain regulatory and contractual compliance.

Monitor and resolve pre-trade compliance alerts and post-trade exceptions, apply SEC and client guidelines, prepare regulatory reports, onboard new accounts and set compliance rules, improve controls and processes, and coordinate with trading, portfolio management, operations, and global support teams to ensure compliant trading activity.

Support design, implementation, and operation of Affirm Bank's BSA/AML and compliance technology. Build and test transaction-monitoring rules, case-management workflows, dashboards, and controls; analyze alerts and control performance; maintain documentation; coordinate across Compliance, Product, Engineering, Data, and vendors to ensure audit-ready, scalable compliance systems.