Job Description

DEPARTMENT: Digital Services & Solutions Security & Compliance

NORC's Digital Services & Solutions group provides technology services to our staff and clients. Given the critical role technology plays in our day-to-day lives, we are committed to providing professional, high-quality solutions in order to further our collective goal of advancing social science research.

RESPONSIBILITIES:

• Perform and support continuous monitoring activities across NORC systems and environments to assess the ongoing effectiveness of security controls and identify changes that may impact system risk or compliance.
• Monitor security and compliance findings, vulnerabilities, control deficiencies, remediation activities, exceptions, and other risk indicators to ensure issues are appropriately documented, assigned, tracked, and resolved.
• Review continuous monitoring outputs from security and IT tools and work with Security Engineers, system owners, and other stakeholders to evaluate findings, determine compliance impact, and coordinate remediation.
• Track and report on Corrective Action Plans (CAPs), Plans of Action and Milestones (POA&Ms), control deficiencies, vulnerabilities, exceptions, and remediation activities, including aging, status, ownership, and closure.
• Perform recurring reviews of security controls and supporting evidence to validate continued compliance with requirements such as FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, ISO 27001, FISMA, HITRUST, and applicable contractual requirements.
• Conduct Security Impact Analyses (SIAs) and risk assessments for system, infrastructure, application, and configuration changes to determine potential impacts to security controls, compliance requirements, and organizational risk.
• Utilize and support ServiceNow GRC/IRM to manage controls, risks, issues, findings, evidence, remediation activities, exceptions, and other compliance-related workflows.
• Maintain accurate and complete GRC records within ServiceNow, ensuring compliance activities, control assessments, findings, risks, and remediation efforts are appropriately documented and traceable.
• Support the development, configuration, and improvement of ServiceNow GRC/IRM workflows, dashboards, reporting, control mappings, and automated compliance processes to improve visibility and efficiency across the compliance program.
• Develop and maintain compliance metrics, dashboards, and reporting that provide visibility into control effectiveness, outstanding findings, remediation progress, risk trends, and overall compliance posture.
• Support internal and external IT compliance audits and assessments, including evidence collection, control validation, documentation review, auditor coordination, and remediation tracking for frameworks such as FedRAMP, CMMC, NIST 800-171, and ISO 27001.
• Develop, review, and maintain key security and compliance documentation, including System Security Plans (SSPs), Corrective Action Plans (CAPs), POA&Ms, Contingency Plans, control implementation documentation, policies, procedures, and supporting evidence
• Collaborate with Security Engineers, system owners, application teams, and other stakeholders to remediate security and compliance issues and maintain alignment with applicable regulatory and contractual requirements.
• Assist in the development and improvement of policies, procedures, control processes, and automated compliance activities for hybrid and multi-tenant infrastructures.
• Translate regulatory, contractual, and security control requirements into actionable technical and operational steps for IT teams and system owners.
• Foster strong, collaborative relationships with NORC’s research community, IT teams, and other key stakeholders to support a culture of security, risk awareness, and continuous compliance.

REQUIRED SKILLS:

• Bachelor’s Degree in Management Information Systems, Computer Science, Business Administration, or a related field. Equivalent experience in IT security, risk, or compliance may be considered.
• Current certification in IT security, risk, or compliance, such as Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), or Certified in Risk and Information Systems Control (CRISC)
• Minimum of 6+ years of experience in IT security, continuous monitoring, risk assessment, compliance, or auditing, with significant experience supporting government security frameworks and contractual requirements.
• Demonstrated experience performing continuous monitoring activities, including security control reviews, vulnerability and finding management, remediation tracking, compliance evidence review, risk identification, and reporting.
• Experience performing Security Impact Analyses, risk assessments, and control assessments for information systems and technology changes.
• Hands-on experience working with ServiceNow GRC/IRM or comparable Governance, Risk, and Compliance platforms, including managing controls, risks, issues, findings, evidence, and remediation activities.
• Experience developing or maintaining GRC workflows, dashboards, metrics, reporting, and compliance tracking processes
• Experience supporting internal and external audits and assessments, including preparing and reviewing System Security Plans (SSPs), Corrective Action Plans (CAPs), POA&Ms, Contingency Plans, and control evidence
• Strong working knowledge of security and compliance frameworks, including FedRAMP, CMMC, NIST 800-171, NIST SP 800-53, ISO 27001, FISMA, and HITRUST
• Strong understanding of information security controls across infrastructure layers, including networks, servers, databases, cloud environments, and applications.
• Experience supporting compliance within hybrid and multi-tenant infrastructures and familiarity with privacy requirements such as GDPR, CCPA/CPRA, HIPAA Security Rule, and HIPAA Privacy Rule.

Qualified applicants must be eligible to work in the U.S. We regret that we are unable to offer visa sponsorship for this position.

SALARY AND BENEFITS:

WHAT WE DO:

NORC at the University of Chicago is an objective, non-partisan research institution that delivers reliable data and rigorous analysis to guide critical programmatic, business, and policy decisions. Since 1941, our teams have conducted groundbreaking studies, created and applied innovative methods and tools, and advanced principles of scientific integrity and collaboration. Today, government, corporate, and nonprofit clients around the world partner with us to transform increasingly complex information into useful knowledge.

WHO WE ARE:

For over 80 years, NORC has evolved in many ways, moving the needle with research methods, technical applications and groundbreaking research findings. But our tradition of excellence, passion for innovation, and commitment to collegiality have remained constant components of who we are as a brand, and who each of us is as a member of the NORC team. With world-class benefits, a business casual environment, and an emphasis on continuous learning, NORC is a place where people join for the stellar research and analysis work for which we’re known, and stay for the relationships they form with their colleagues who take pride in the impact their work is making on a global scale.

EEO STATEMENT:

NORC is an equal opportunity employer. NORC evaluates qualified applicants without regard to race, color, religion, sex, gender, national origin, disability, status as a protected veteran, sexual orientation, and other legally protected characteristics.