Corporate Compliance and Ethics Work in 2026: A U.S. Vacancy Study

Research date: 15 October 2026
Evidence base: 104 current U.S. employer-hosted requisitions in a structured purposive sample, with 12 contextual comparisons and two exclusions held outside the principal analysis.

Executive summary

Corporate compliance and ethics work in the sampled advertisements is described as an operating system, not simply a policy library. Employers ask practitioners to connect risk assessment, policies, training, third-party review, reporting channels, investigations, monitoring, remediation and management reporting. The shape of that system changes by employer. A utility's manager may be responsible for a code of conduct and an ethical-culture assessment; an aerospace compliance manager may coordinate corrective-action closure; a technology company's anti-corruption manager may focus on third-party screening and transaction risk. These are different jobs within a common control chain. Consumers Energy, RTX, Salesforce.

Three observations organize the evidence. First, the advertisements cited below name work products: risk assessments, case files, policy updates, dashboards, corrective-action records and reports for executives or boards. Second, jobs distinguish an operator's authority from the decision authority of counsel, a committee, an investigation leader or a business owner. Third, sector-specific rules shape the day-to-day work; a common job title does not make a banking, healthcare, manufacturing or logistics control interchangeable. The sample documents what these employers requested on the research date. It does not estimate national hiring demand or prove that an employer's actual program operates as advertised.

Question, sample and method

The study asks: What work do U.S. employer advertisements explicitly assign to people who run or support corporate compliance and ethics programs? The unit is one employer-hosted requisition with an eligible U.S. location, a visible role description and a job-specific application control on 15 October 2026. A role advertised in several cities was counted once. Search engines and third-party listings were used to discover leads; admission depended on the employer's career site or applicant-tracking system. The rights-safe source roster records the URL, identity, collection date and short necessary excerpt for each role. Coding records duties, expected outputs, hard skills, observable soft skills, tools, required and preferred qualifications, cadence, interfaces, authority and escalation.

The resulting principal set has 104 unique roles. Another 12 are retained as explicitly labelled context, and two are excluded. The collection is purposive: it intentionally spans general program positions and meaningful specialist work in anti-corruption, third-party risk, investigations, monitoring and training. It is not a random sample of all vacancies. Roles devoted only to legal counsel, banking transaction monitoring, cyber controls, product quality, corporate-secretarial filings or internships were outside the principal frame. A live description with a conflicting elapsed deadline was also excluded pending resolution. The Western Digital posting illustrates that boundary: the displayed anticipated application deadline had passed even though an interest control remained visible.

The principal employer mix is descriptive: 30 healthcare and life-sciences roles, 24 financial-services roles and 50 roles across other sectors. “Other” includes heterogeneous activities such as software, industrial manufacturing, energy, logistics, media, retail, hospitality and professional services. These figures describe this deliberately assembled corpus, not the composition of U.S. employment. A diversified employer may cross sector boundaries, so the grouping assigns each sampled role one analytical sector for this study. The public, broader occupational descriptions from the Bureau of Labor Statistics and O*NET are background only; their compliance-officer category includes occupations outside this corporate ethics sample.

Which duties the advertisements explicitly assign

Each of the 104 principal postings was coded for 16 duty themes. An explicit code requires a stated responsibility or work product; a title or preferred skill alone does not qualify. An ambiguous code preserves partial evidence, while not stated means the advertisement does not provide enough evidence. A job may receive several explicit codes. The counts below describe this targeted sample, not the share of all U.S. compliance jobs.

The most frequently explicit themes in this corpus were training and communications (66 of 104), policies or a code (63), risk assessment (51), program governance (49), remediation (47), monitoring or testing (46) and executive or board reporting (43). Investigation duties appeared explicitly in 36 postings, third-party integrity in 29, anti-bribery or FCPA work in 20, conflicts or gifts in 19, and speak-up intake in 16. More specialised or sector-specific themes were regulatory-change work (13), financial-crime or AML-related work (10), privacy or data governance (9) and sanctions or trade (8). The financial-crime category includes fraud-related duties; its count must not be read as ten AML-program roles.

Several duties appear together in a single role. Policy/code work and training were both explicit in 51 postings; risk assessment and monitoring/testing in 27; third-party integrity and anti-bribery in 15; and speak-up intake and investigations in 11. These pair counts overlap and are not separate job categories. Employer descriptions such as Cargill, Bekaert, Regal Rexnord and Pilot Company show why one advertisement can carry several codes.

These are conservative within-sample observations: the numerator excludes ambiguous cases, and the denominator contains intentionally selected general and specialist roles from several sectors. A missing explicit code does not mean an employer has no such responsibility. The source-linked Role Requirements Matrix records each role's work; the separate thematic coding ledger preserves the explicit, ambiguous or not-stated judgment and its supporting phrase so the count can be checked or recoded if a posting changes.

Program architecture is a working responsibility

Several employers seek someone who can translate an enterprise standard into processes that different business units can use. Pilot Company places policy, risk assessment, intake, investigations, training, monitoring and third-party risk under an enterprise director who reports to senior leadership and the board. Boeing's subsidiary compliance manager is asked to extend enterprise requirements into subsidiaries, assess local risks and coordinate mitigation. Airbus Americas describes a regional head who owns the risk assessment and oversees corrective actions. The recurring practical question is how a central requirement becomes a named activity with an owner, evidence and follow-up in a particular operating unit.

The code of conduct appears as a maintained control rather than a one-time writing task. Consumers Energy assigns policy maintenance alongside advice on conflicts of interest, gifts, retaliation prevention and reporting obligations. TriNet connects its code refresh with disclosure reviews, case management, communications and culture measures. At a higher level, Gilead's chief ethics and compliance officer is tasked with the governance, resources and risk oversight of a global program, with direct access to senior leadership and the board. This is a different authority level from an analyst who coordinates a policy calendar or prepares a report.

The 2025 U.S. Sentencing Guidelines, §8B2.1 set out seven minimum requirements for an effective program in the organizational-sentencing framework and call for periodic risk assessment. The DOJ's September 2024 Evaluation of Corporate Compliance Programs frames review around design, resourcing and operation in practice; it explicitly rejects a universal checklist. These are established U.S. baseline perspectives, separate from what the 2026 vacancy sample shows. They help explain why an advertisement may ask for both written standards and evidence that a process runs, without making every listed employer subject to the same legal duty.

Risk assessment and monitoring turn judgment into a record

Risk work in the postings is more specific than “identify risks.” Consumers Energy asks its manager to prioritize ethics risks, test controls, track remediation and use helpline, training, culture and case data to evaluate effectiveness. McKinsey's technology-sector ethics manager links risk identification to monitoring client-service work and reviewing proposed activities. AbbVie describes a program-strategy role that converts risk signals into projects, management recommendations and board-facing materials. Their outputs differ, but each requires a way to show which signal was assessed and what decision followed.

Data roles make monitoring visible. SLB's ethics and compliance data analyst is asked to build dashboards, monitor case and training indicators, improve data quality and prepare information for leadership. RTX's corrective-action lead owns issue intake, root-cause coordination, action tracking, closure evidence and an audit trail. DICK'S Sporting Goods assigns an analyst policy governance and regulatory-change tracking. A dashboard is therefore only one part of the work: the employer also needs trustworthy underlying records, a responsible reviewer and a procedure when a metric reveals a delayed or ineffective action.

The advertisements do not establish a standard set of key performance indicators for every company. One employer may measure completion of a corrective action; another may need a board-level picture of complaints, training or third-party exposure. The safer synthesis is to define the question first, trace it to a reliable data source and record who can interpret and act on the result. This is an inference from the assignments in the SLB, RTX and Consumers Energy postings, not a claimed benchmark.

Anti-corruption and third-party work are lifecycle tasks

Third-party integrity roles show why screening and due diligence cannot be reduced to a single name check. Salesforce assigns an anti-corruption manager prospective partner diligence, transaction-risk analysis, mitigation recommendations and support for high-risk third-party audits. Bekaert combines higher-risk third-party monitoring with anti-bribery, sanctions, export-control and internal-audit work in its U.S. regional position. Worldwide Flight Services asks its corporate manager to assist with business-partner diligence while administering code, policy, training and risk-assessment processes. The common operational chain is risk classification, review, an informed recommendation, a documented decision and re-evaluation when the relationship or activity changes.

Other advertisements show that the relationship can change after a transaction. Henry Schein assigns its manager ethics and compliance due diligence for acquisitions and post-close integration. Pilot Company describes third-party screening plus continuing governance. Verifone connects anti-bribery controls with gift review and investigations. These roles support a practical distinction: a file can document an initial check while still failing to define who reviews new facts, payments, agents or exceptions later.

EQT Corporation uses KYC language for counterparty packets and ongoing screening, while Salesforce and Bekaert describe anti-corruption and sanctions-related third-party controls. These activities do not automatically become a bank Customer Identification Program or imply that all employers must run financial-institution controls. The separately published MTF review of 2026 enforcement signals discusses agency records and regulatory scope. Its cases and updates are context, not evidence for the vacancy counts or the prevalence of any duty here.

Reporting channels and investigations require controlled handoffs

The sampled investigations roles spell out a sequence that general program descriptions often compress: receive a concern, assess immediate risk, preserve evidence, plan a fair inquiry, interview, evaluate facts, record findings, recommend action and track closure. TriNet asks its lead program manager to handle disclosures and concerns, investigate misconduct, collect electronic evidence, interview witnesses and subjects, write findings, conduct root-cause analysis and administer the case system. KLA seeks a corporate investigator for full-cycle inquiries and evidence work. Wynn Resorts places investigative strategy, sensitive case oversight, metrics and fraud-prevention training with an executive director. These adverts support the sequence; they do not grant every practitioner the same authority to make a disciplinary or legal decision.

The cited postings connect reporting channels with case routing, investigation and follow-up. Verifone puts speak-up intake, investigations and reporting in an officer role. TriNet ties case administration to its broader ethics program; Geotab pairs internal investigations with policies and risk assessment. Airbus Americas gives its regional head oversight of investigations and remediation. These examples show distinct possible handoffs between the person who receives information, the person who investigates, the owner of a control and the authority that decides what happens next.

The job evidence also favors restraint in describing outcomes. An allegation is not a finding; a completed interview is not a closed case; a corrective action promised is not a control tested. The RTX and TriNet adverts explicitly connect findings to root cause, documented action and closure. A report that keeps these stages separate is more useful to a reviewer than a single “resolved” label. This is an operational inference from the roles, not a claim that either employer uses one common investigation template.

Training administration and culture measurement

Employers describe training as administration, adaptation and follow-up. Waters Corporation assigns a global operations director the learning curriculum alongside policy and systems governance. Pilot Company's policy, training and governance analyst manages policy and training processes and related measures. Capital One's training analyst works with mandatory training, process controls and learning-system data. The work product is more than a presentation: it includes audience selection, assignment, completion data, exceptions and a decision about what the information means.

Culture roles also reach beyond course completion. Consumers Energy connects speak-up culture with case, helpline, survey and training evidence. TriNet identifies communications, ethics ambassadors, a culture survey and recognition activities within one program remit. Crowley's ethics and compliance analyst supports inventories, policy lifecycle and management reporting. Together, these postings describe both routes for employees to raise questions and ways to review whether guidance is used in practice. This does not establish a measured change in employee behavior.

Qualifications, tools and the meaning of “required”

The advertisements vary considerably by level. Salesforce lists a shorter experience threshold, a bachelor's degree or equivalent experience and familiarity with anti-corruption law; certain platforms are preferred. Worldwide Flight Services distinguishes an experience route with a law degree from a longer route without one, and places multinational work and several certifications under preferred skills. TriNet seeks extensive corporate investigations experience and lists legal education and CCEP/LPEC credentials as preferences. Consumers Energy offers alternative education-plus-experience routes. The reading rule is simple: retain the employer's required/preferred distinction and do not turn a preference into an entry barrier.

Tooling appears where it serves a task. The corpus includes case-management systems in TriNet and Wynn Resorts, dashboard or analytics tools in SLB, and workflow automation in ServiceNow. The skill is to define the record, access, review step and output before choosing an application. A named product in one posting is not evidence that all employers use it.

Observable interpersonal skills are equally concrete. Bekaert needs a professional who can translate complex requirements into usable advice while handling sensitive matters. McKinsey's technology-sector manager must advise and influence delivery teams. Wynn Resorts requires objective, confidential communication across an investigation. These are behaviorally testable descriptions: explain a risk clearly, preserve discretion, ask an unbiased question, coordinate a handoff and record the result.

Authority, cadence and boundaries

An advertisement may use “manage” for a process without giving the holder final decision power. Salesforce's anti-corruption manager recommends controls under director oversight. RTX's corrective-action lead owns the action process and escalates delays. Pilot's director is an escalation point for complex matters; Gilead's CCO has a direct board-facing role. Recording those different decision rights prevents an analyst's draft recommendation from being mistaken for an approval.

Cadence is similarly role-specific. TriNet identifies annual code and training refreshes and a quarterly communication series. SLB contributes to quarterly board reporting and recurring dashboards. Consumers Energy describes annual plans and continuing effectiveness review. Many advertisements leave frequency unstated. This study records that silence as “not stated”; it does not fill it with a generic monthly or annual cycle.

Adjacent titles were separated when their central work answered another question. Stord's compliance program manager centers on EHS, OSHA, EPA and warehousing-specific regulatory programs. Jabil's social compliance auditor focuses on labor conditions at manufacturing sites. Samsung Austin Semiconductor's construction case manager tracks a construction funding and contractor record workflow. They are useful comparisons but do not define the principal enterprise ethics role. A separate NBCUniversal corporate-governance manager is primarily concerned with entity and secretary work. Its title alone would have overstated the ethics-program evidence.

Operational synthesis and limits

The postings suggest a compact way to describe the job's operating logic: identify a material risk or report; assign a competent owner; gather enough facts for a proportionate decision; record the rationale and authority; implement a control or response; and check whether it worked. The links in that chain appear in different roles: Salesforce emphasizes third-party risk review, TriNet intake and investigations, RTX remediation evidence, and Consumers Energy program effectiveness and culture. This is an original synthesis of described responsibilities, not a uniform employer procedure.

The limitations are material. Publicly visible ads change or close quickly. Search visibility and employer ATS access shape which roles can be observed. Titles are inconsistent, and this purposive set deliberately includes senior leaders and regulated-sector specialists alongside analysts. Advertisements state desired work; they do not independently verify program effectiveness, employee conduct, organizational outcomes or the outcome of an investigation. The 30/24/50 sector mix and all qualitative patterns apply to this sampled set only. The source roster preserves employer URLs and short excerpts so a reader can examine the underlying advertisements without reproducing job bodies. The separate official-source material explains occupational and regulatory context; it does not enlarge the vacancy denominator.

The practical conclusion is that corporate ethics and compliance work is best understood through documented decisions and handoffs. Policies, risk matrices, due-diligence files, investigation reports and dashboards become useful when the organization can identify the owner, the evidence considered, the decision authority, the escalation path and the follow-up. That is the common thread across the eligible U.S. postings, while the rule set, expertise and authority remain particular to each employer and sector.

Continue learning

Apply the evidence from this report through MTF Institute's Professional Certificate in Corporate Compliance & Ethics Management. The programme turns the identified capabilities into structured theory, guided AI practice and reusable workplace artifacts.