Principal Analyst, IT Compliance

Overview

This role, Principal Analyst, IT Compliance, develops and documents strategies to ensure IT practices comply with applicable laws, regulations, and industry standards—such as Sarbanes-Oxley (SOX) and Payment Card Industry (PCI) compliance. You will act as a trusted advisor to senior management and serve as the interface between IT and internal and external auditors.

You will lead and conduct assessments in the most critical areas of IT compliance, present findings, and review audit findings. The position requires absolute confidentiality for sensitive files, data, and materials accessed, discussed, or observed, while following compliance policies and procedures.

Responsibilities

Regulatory Compliance Assessment

• Lead and oversee assessments conducted by more junior analysts.
• Review evidence demonstrating compliance with applicable laws, regulations, and industry standards.
• Interview stakeholders to ensure compliance requirements are met and understood.
• Review policies, procedures, and controls for alignment with requirements.
• Resolve compliance issues in partnership with cross-functional teams.
• Represent IT when communicating compliance work products to internal and external stakeholders and executive leadership.

Research and Innovation (SME for IT Compliance)

• Stay current on emerging technologies, industry trends, and best practices.
• Research and evaluate new tools, frameworks, and methodologies that improve solution designs and delivery.
• Recommend appropriate solutions and develop technology roadmaps.
• Review and improve tools, methods, processes, and procedures.

Compliance Monitoring and Reporting

• Lead ongoing compliance activities.
• Track regulatory changes and prepare reports for management and regulatory agencies.
• Document compliance findings and issues, and serve as the decision maker for remediation efforts.
• Conduct impact assessments for regulatory changes and report findings to leadership.
• Assess compliance-related risks and lead development of risk mitigation strategies.
• Build processes that drive automation and continuous compliance monitoring.

Internal and External Audits and Reviews

• Conduct internal assessments and reviews to evaluate control effectiveness and identify improvement opportunities.
• Review access controls, data protection measures, and security configurations.
• Lead responses to internal and external audits and stakeholder findings/inquiries, including preparing and presenting official documentation where appropriate.

Training and Awareness

• Serve as the top expert on compliance policies, standards, and procedures.
• Provide training and awareness programs for analysts and other stakeholders.

Policy and Procedure Development

• Lead development, review, and updates to IT policies, procedures, and standards to address compliance requirements.
• Review and approve documents such as acceptable use policies and data retention policy plans.
• Communicate policies and procedures to stakeholders and executive leadership.

Vendor and Third-Party Compliance Management

• Provide oversight and decision-making in vendor selection.
• Assess vendor and third-party service provider compliance with security and regulatory requirements.
• Oversee audits of third-party service providers and lead efforts to resolve vendor issues.

Other Duties

• Perform other duties as assigned.

Qualifications

Education

• Bachelor’s Degree in information technology, computer science, or related field, or equivalent work experience.

Experience

• 7 years’ experience including:
  • As an Auditor/assessor in a regulatory environment.
  • Conducting assessments specific to PCI and SOX.
  • Applying access controls and IAM principles.
  • Implementing and assessing segregation or separations of duties.
  • Working in a compliance role as part of a large Information Technology department.
  • Documenting and communicating regulatory requirements, standards, policies, procedures, and vulnerabilities related to compliance.
  • Leading critical compliance projects.
• 5+ years experience including:
  • Participating in cross-functional technology teams.
  • Planning and managing large projects.
  • Serving as an auditor for IT systems.

Required Certifications

• CISA (Certified Information Systems Auditor) or CIA (Certified Internal Audit)

Preferred Qualifications

• PMP (Project Management Professional)
• CISM (Certified Information Security Manager)
• CFSA (Certified Financial Systems Analyst)
• CITGCP (Certified IT General Controls Practitioner)
• CSOXI (Certified Sarbanes Oxley Act Practitioner)
• PCIP (Payment Card Industry Professional)
• CISSP (Certified Information Systems Security Professional)

Preferred Experience

• 1+ year in the cruise and/or travel industry

Knowledge, Skills, and Abilities

• Expert-level knowledge of systems architecture and network applications/protocols, configuration, logging, monitoring, and administration to understand compliance impacts.
• Ability to support a multisite enterprise environment.
• Recognized strategic authority in regulatory and security standards/requirements including PCI, SOX, and GDPR.
• Expertise in cybersecurity frameworks such as NIST CSF.
• Ability to engage and manage compliance projects to successful outcomes.
• Intermediate-to-advanced technical knowledge across cloud platforms (AWS, Azure, GCP), IAM/PAM systems, Operating Systems (Linux/Windows), Databases, and DevOps/CI-CD pipelines to support control validation and risk.
• Ability to develop dashboards and reports for executive consumption.
• Advanced critical thinking, creative problem solving, and root-cause analysis with the ability to lead teams.
• Flexibility to adjust to changing priorities and manage multiple deadlines.
• Strong analytical skills and attention to detail with exceptional business acumen.
• Ability to manage tight deadlines, prioritize workload, and deliver exceptional results.
• Ability to write and review comprehensive and concise technical reports and presentations for non-technical audiences.
• Ability to create and deliver PowerPoint presentations to various audiences, including executive management.
• Exceptional communication, team building, conflict management, and organizational skills.
• Strong track record working collaboratively with cross-functional teams.
• Proficiency in MS Office.
• Proven ability to quickly learn and teach new technologies and concepts.
• Demonstrated capability in managing organizational dynamics.

Physical Demands

• Must be able to remain in a stationary position at a desk and/or computer for extended periods of time.

Travel

• Less than 25% non-shipboard travel likely.

Work Conditions

• Work primarily in a climate-controlled environment with minimal safety/health hazard potential.

Location

• This position is classified as “remote.” Full-time work from home is allowed.
• Regular travel to headquarters in Miami, FL may be required for in-office collaboration.
• Primary sourcing areas: remote hubs of Orlando, Tampa, Atlanta, Houston, and Dallas.
• If the search is extended past those areas, candidates must be located in one of the following U.S. states: FL, GA, TX and NC

Compensation & Benefits

At least for non-sales roles, an annual cash bonus program; sales roles have an incentive plan. Director and above roles may also be eligible to participate in a discretionary equity incentive plan.

Benefits include:

• Medical, dental, and vision plans
• Employee Assistance Program and other mental health resources
• Company paid term life insurance and disability coverage
• 401(k) plan with company match
• Employee Stock Purchase plan
• Paid Time Off:
  • 8 company-wide holidays for full-time and part-time with benefits employees, plus 2 additional floating holidays at the employee’s discretion
  • Vacation: 14 days/year for full-time employees at the manager and below level; 19 days/year for director and above level; part-time with benefits based on hours worked with a minimum of 84 hours/year
  • Sick time: 80 hours/year for full-time employees; part-time with benefits based on hours worked with a minimum of 60 hours/year
• Complementary stand-by cruises, employee discounts on confirmed cruises, and special rates for family and friends
• Personal and professional learning and development resources including tuition reimbursement