The Role
Supports Huron’s governance, risk, and compliance program by maintaining security policies, risk and issue logs, audit evidence, corrective actions, and compliance documentation. Coordinates ISO 27001, SOC 2, HIPAA, CMMC, SOX, and other audits; manages policy exceptions, vendor risk reviews, client security questionnaires, business continuity activities, and security metrics. Partners with IT, Legal, auditors, clients, and business stakeholders while supporting incident investigations, security awareness, and GRC process improvement.
Summary Generated by Built In
Huron is redefining what a global consulting organization can be. Advancing new ideas every day to build even stronger clients, individuals and communities. We’re helping our clients find new ways to drive growth, enhance business performance and sustain leadership in the markets they serve. And, we’re developing strategies and implementing solutions that enable the transformative change they need to own their future.
As a member of the Huron corporate team, you’ll help to evolve our business model to stay ahead of market forces, industry trends and client needs. Our accounting, finance, human resources, IT, legal, marketing and facilities management professionals work collaboratively to support Huron’s collective strategies and enable real transformation to produce sustainable business results.
Join our team and create your future.
You will support Huron’s governance, risk, and compliance program and its certification, assurance, and regulatory obligations, including ISO/IEC 27001:2022, ISO 22301, SOC 2, HIPAA, CMMC, and SOX, working closely with IT, Legal, and business partners and SMEs. Strong attention to detail, clear written communication, and the ability to manage many concurrent requests are essential.
As the Sr. Compliance Specialist (Associate), you will:
• Support the review, update, and rollout of Huron IT and Security policies and procedures, and maintain ISMS documentation for ISO/IEC 27001:2022
• Maintain the GRC risk and issue log and risk exception records, working with owners to keep ratings, due dates, and status current
• Manage policy exceptions (vulnerability, end-of-life (EOL), and other requests) with business teams, tracking deadlines and obtaining leadership approval
• Gather data for GRC and security metrics, KPIs, and KRIs for management reporting
• Support business impact analyses (BIAs) and business continuity and disaster recovery (DR) testing, including scoping, scheduling, evidence, and follow-up
• Facilitate internal, external, and client audits (e.g., ISO 27001, SOC 2, HIPAA, CMMC, SOX), coordinating auditors and stakeholders and ensuring evidence is complete, accurate, and audit-ready
• Monitor corrective and preventive actions (CAPA) and audit non-conformities through to closure
• Respond to client RFP security sections, questionnaires, and vendor risk assessments, and support contract reviews of security and data protection terms with Huron’s Legal department, escalating non-standard terms
• Assist with vendor onboarding, software approvals, and vendor security reviews using third-party risk management practices
• Assist the Incident Response and third-party risk teams with security incident investigations
• Support security awareness efforts through training completion tracking, phishing follow-up, and Cybersecurity Awareness Month activities
• Contribute to continual process improvement and automation across all GRC workflows.
Requirements:
- Bachelor’s degree required, preferably in Information Security, Information Technology, Information Systems, or a related discipline
- 2-4 years of experience in governance, risk, and compliance, IT audit, information security, or a related security or compliance role
- Working knowledge of common security, attestation, and compliance frameworks (e.g., ISO 27001, ISO 22301, SOX, HIPAA, NIST, SOC 2)
- Strong written and verbal communication skills, with the ability to summarize technical findings for a non-technical audience
- Excellent organizational skills, with the ability to manage a high volume of concurrent requests and track detail accurately
- Customer-oriented approach, comfortable working directly with auditors, clients, and internal stakeholders across IT, Legal, and the business
- Willingness to work US business hours as needed, coordinating daily with a primarily US-based security team
Preferences:
- Experience with GRC platforms (e.g., ServiceNow, OneTrust, Archer, ProcessUnity)
- Relevant security, risk, compliance, or audit certifications (e.g., ISO 27001 Lead Auditor, CISA, CRISC, Security+)
- Familiarity with business continuity and disaster recovery practices (e.g., ISO 22301)
- Experience with Smartsheet, MS Project, SharePoint, or similar tools for tracking and reporting
- Analytical problem-solving skills, including the ability to synthesize compliance and risk data into a format that supports decision-making
Skills Required
- Bachelor’s degree, preferably in Information Security, Information Technology, Information Systems, or a related discipline
- 2-4 years of experience in governance, risk, and compliance, IT audit, information security, or a related security or compliance role
- Working knowledge of security, attestation, and compliance frameworks such as ISO 27001, ISO 22301, SOX, HIPAA, NIST, and SOC 2
- Strong written and verbal communication skills, including the ability to summarize technical findings for non-technical audiences
- Excellent organizational skills and ability to manage concurrent requests and track details accurately
- Customer-oriented approach and comfort working with auditors, clients, IT, Legal, and business stakeholders
- Willingness to work US business hours as needed
- Experience with GRC platforms such as ServiceNow, OneTrust, Archer, or ProcessUnity
- Relevant security, risk, compliance, or audit certification such as ISO 27001 Lead Auditor, CISA, CRISC, or Security+
- Familiarity with business continuity and disaster recovery practices, such as ISO 22301
- Experience with Smartsheet, Microsoft Project, SharePoint, or similar tracking and reporting tools
- Analytical problem-solving skills, including synthesizing compliance and risk data for decision-making
Huron Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Huron and has not been reviewed or approved by Huron.
-
Retirement Support — Retirement programs include a company 401(k) match positioned as a core element of total rewards, signaling strong long‑term savings support. Company materials and filings describe a competitive match structure with broad availability.
-
Equity Value & Accessibility — An employee stock purchase plan provides company‑matched RSUs on purchased shares and is broadly accessible across the workforce, indicating meaningful equity participation. Company filings outline the plan’s match design and wide eligibility.
-
Leave & Time Off Breadth — Policies emphasize flexible/unlimited PTO, paid holidays, and parental leave with caregiving resources, reflecting expansive time‑off options. Careers and benefits pages present flexibility and time away as core components of the package.
Huron Insights
Am I A Good Fit?
Get Personalized Job Insights.
Our AI-powered fit analysis compares your resume with a job listing so you know if your skills & experience align.
Success! Refresh the page to see how your skills align with this role.
The Company
What We Do
Huron is a global consultancy that collaborates with clients to drive strategic growth, ignite innovation and navigate constant change. Through a combination of strategy, expertise and creativity, we help clients accelerate operational, digital and cultural transformation, enabling the change they need to own their future. By embracing diverse perspectives, encouraging new ideas and challenging the status quo, we create sustainable results for the organizations we serve.
