Security Compliance Analyst II
Summary
Runs Lockton's security compliance program from Overland Park, KS: managing end-to-end audit cycles, coordinating control evidence, coaching control owners, and serving as day-to-day liaison for internal/external auditors and client security questionnaires. The focus is GRC, compliance documentation, and policy upkeep rather than hands-on security tooling.
Lockton is seeking an experienced Security Compliance Analyst II to help operate and mature the organization’s security compliance program. This role will manage recurring audit and assessment activities, coordinate evidence and responses, educate control owners, and serve as a knowledgeable liaison with auditors, clients, and internal stakeholders. The successful candidate will combine practical audit-cycle experience with strong communication, organization, and business judgment.
Key Responsibilities
• Manage end-to-end audit and assessment cycles, including planning, scoping, request tracking, evidence coordination, status reporting, walkthroughs, issue follow-up, and closure activities.
• Coordinate with control owners to collect complete, accurate, and timely evidence; evaluate submissions for quality and alignment with control requirements before providing them to auditors or assessors.
• Educate and coach control owners on control intent, evidence expectations, testing approaches, recurring deadlines, and sustainable compliance practices.
• Act as a primary day-to-day contact for internal and external auditors by coordinating meetings, clarifying requests, facilitating walkthroughs, and tracking open questions and commitments.
• Support compliance initiatives and the continued evolution of controls toward repeatable, measurable, and increasingly continuous monitoring practices.
• Maintain compliance documentation, including control narratives, evidence inventories, testing records, remediation plans, procedures, and management-ready status reporting.
• Identify control gaps, evidence weaknesses, and process inefficiencies; partner with control owners and technology teams to define practical remediation actions and monitor progress.
• Contribute to the development, review, and maintenance of cybersecurity policies, standards, and procedures to support security, compliance, and business requirements.
• Prepare responses to client security questionnaires and other client inquiries regarding Lockton’s security program, controls, assurance activities, and risk-management practices.
• Participate in client and prospective-client discussions, presenting security and compliance information clearly while appropriately managing sensitive or restricted information.
• Partner with Information Security, Information Technology, Legal, Privacy, Risk, and business stakeholders to support projects and communicate compliance impacts and obligations.
• Contribute to the maintenance and improvement of approved response content, supporting documentation, and reusable materials for client assurance activities.
• Review security and compliance language in contracts, addenda, and customer requirements when needed; identify concerns and coordinate feedback with Legal and relevant subject-matter experts.
• Stay current on relevant cybersecurity compliance expectations, audit practices, and industry developments.