Security Compliance Analyst I

Lockton is seeking a Security Compliance Analyst I to support its security compliance and client-assurance activities. The role coordinates audits and evidence collection, supports control owners and auditor interactions, maintains compliance documentation, and helps prepare client security responses.

What you'll do:

• Support audit and assessment cycles by maintaining request lists, coordinating evidence collection, tracking deadlines, scheduling walkthroughs, documenting questions, and following up on open items
• Work with control owners to collect complete, accurate, and timely evidence; perform an initial quality review before materials are submitted for further review or provided to auditors
• Help educate control owners on control intent, evidence expectations, recurring deadlines, and documentation standards
• Support interactions with internal and external auditors, including meeting coordination, request clarification, walkthrough preparation, and tracking follow-up questions and commitments
• Maintain compliance documentation such as control narratives, evidence inventories, procedures, testing records, issue logs, and remediation trackers
• Identify missing evidence, documentation inconsistencies, and potential control gaps; escalate concerns and assist with remediation follow-up
• Contribute to the development, review, and maintenance of cybersecurity policies, standards, and procedures to support security, compliance, and business requirements
• Prepare and maintain draft responses to client security questionnaires and due-diligence requests using approved information about Lockton’s security program and controls
• Assist with client and prospective-client security discussions by preparing materials, documenting questions, and coordinating responses with subject-matter experts
• Maintain reusable answer content and supporting documentation for client assurance activities
• Partner with Information Security, Information Technology, Legal, Privacy, Risk, and business stakeholders on compliance-related requests and projects
• Stay current on cybersecurity compliance concepts, audit practices, and relevant industry developments

What they're looking for:

• 1-3 years of experience in cybersecurity compliance, information security governance, technology risk, IT audit, client assurance, or a related field
• Experience supporting audits, assessments, control testing, evidence collection, or remediation tracking
• Experience coordinating with technical or business stakeholders to obtain documentation and meet deadlines
• Ability to understand control requirements and communicate evidence expectations clearly to control owners
• Experience contributing to client security questionnaires, due-diligence requests, or similar written responses
• Foundational knowledge of security controls, risk concepts, audit evidence, and cybersecurity compliance frameworks or assurance programs
• Strong written and verbal communication skills, attention to detail, and the ability to self-direct, prioritize tasks independently, and organize multiple assignments and deadlines
• Sound judgment and discretion when handling confidential, sensitive, or restricted information
• Bachelor's degree in Information Security, Cybersecurity, Information Technology, Business, Risk Management, or a related field, or equivalent practical experience
• Familiarity with reviewing cybersecurity, privacy, audit, or compliance provisions in contracts and customer agreements
• Exposure to SOC 2, HITRUST, ISO 27001, NYDFS, or comparable security compliance and assurance activities
• Experience with governance, risk, and compliance platforms, evidence repositories, questionnaire-response tools, or workflow systems