Senior Governance, Risk & Compliance Analyst

Posting Type

Hybrid/Remote

Job Overview

The Senior Governance, Risk, and Compliance (GRC) Analyst supports second-line assurance for Relativity’s control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They independently own assigned control areas, perform integrated IT control testing, and advise first-line teams on the effective operationalization of controls with periodic oversight from GRC leadership and Staff-level team members. This role is responsible for continuous testing of IT General Controls (ITGC), maintaining assigned portions of Relativity’s Risk and Control Matrix (RCM), and delivering accurate, complete and audit-ready output on schedule. Expected to serve as a knowledgeable resource on IT risk assurance and to possess a working command of IT governance, risk and compliance practices.

• The following are key to success in this role:
• o Strong risk reasoning and decision quality: analyzes and rates risk independently, distinguishes exploitable exposure from theoretical findings, and recommends proportionate treatment with named owners and dates; able to lead analysis of complex or novel scenarios with minimal supervision.
• oWorking knowledge of IT control design with the technical depth to verify that a control operates where the risk resides rather than accepting its documented presence.
• o Proficiency building and operating automated evidence collection and control testing for known systems, replacing manual and screenshot-based evidence with queryable authoritative sources.
• o Methodical problem solver who resolves issues creatively and in deliberate sequence – GRC isn’t the office of “No,” we expand the possibility of “Yes.”
• o You execute defined priorities with independence and quality, and escalate promptly when work falls outside established patterns.
• o You take pride in your work and own outcomes of efforts assigned to you.
• o You communicate and negotiate effectively with engineering, product and business counterparts, translating technical detail into risk and business terms and back again without losing accuracy.
• o Working fluency in common security frameworks, regulations and industry standards, with the ability to decompose requirements into implementable control language.

Job Description and Requirements

What are the core duties of this role?

• •Support and execute second line of defense activities.
• •Maintain assigned information security policies and standards aligned to management’s control framework, and continuously assess the adequacy and effectiveness of controls placed in operation.
• •Identify and report risks with defensible, well-reasoned analysis, stating assumptions and confidence; provide gap analyses and remediation recommendations with named owners and dates.
• •Provide guidance and interpretation on control requirements within assigned control areas, aligned with control objectives.
• •Monitor control performance and recommend optimization to first line of defense for control rationalization and continued alignment to standards.
• •Track, report and account for control deficiencies, exceptions, gaps and weaknesses within assigned areas and drive them to closure.
• •Maintain and update assigned entries in the information security risk register and contribute to quarterly reporting to the CISO and management.
• •Aggregate and report risk metrics to information security leadership.

• •Serve as a knowledgeable resource on the nature, timing and extent of IT controls aligned to standardized frameworks. Supports a control environment that enables organizational outcomes and reduces audit lifecycle burden. Operates, monitors and helps optimize the technical control environment within assigned domains.
• •Performs IT risk analysis in alignment with the IT risk appetite and thresholds set by GRC leadership and ERM.
• •Designs and validates controls for known systems and patterns, applying IT control architecture standards set by senior team members, and favors platform and pipeline enforcement over controls dependent on human diligence.
• •Partners with engineering and business teams to embed controls that balance assurance, operational burden and technical enablement.
• •Interprets and applies framework requirements to assigned control domains, identifying where one control satisfies multiple frameworks and distinguishing what a framework requires from convention or preference.
• •Maintains working fluency in information security standards, benchmarks, frameworks and regulatory guidance, and tracks framework revisions and changes in assessor testing expectations relevant to assigned areas.
• •Supports internal audit, third line of defense and relevant stakeholders in executing enterprise-wide integrated audits (e.g., SOX, ISO 27001, SOC 2, FedRAMP).
• •Contributes to periodic analysis of information security’s maturation against standards and supports preparation of leadership reporting on security program maturity.
• •Diagnoses and resolves findings independently across known systems, forming and testing hypotheses in deliberate sequence, correlating evidence across sources, and converting resolutions into automated validation so the same finding does not recur.
• •Represents GRC with engineering, product and business counterparts, securing commitment to remediation from teams outside direct reporting lines; supports GRC and Security management and leadership in executive, customer and auditor forums.

• •Collaborates cross-organizationally to support SOX readiness initiatives and integrated audits; developing, testing and monitoring controls and identifying opportunities for control homogenization to reduce the organizational cost of controls and detection risk. Reporting periodically to relevant stakeholders on progress, status, exceptions and the associated risk profile.
• •Support pre-assessment reviews of FedRAMP Moderate and/or High authorization packages aligned to relevant criteria, validating evidence completeness and identifying gaps ahead of external AO and 3PAO review activities.

Mi nimum qualifications:

• •4+ years of professional experience in IT audit, risk management, or compliance, with hands-on ITGC testing experience.
• •Working knowledge of and experience with risk and control frameworks, including NIST CSF 2.0, NIST 800-53, ISO/IEC 27001, AICPA Trust Services Criteria (SOC 2), COSO, COBIT and/or FedRAMP, including requirement translation and common-control cross-walking.
• •Advanced-tier GRC certification such as Certified in Risk and Information Systems Control (CRISC), Certified in Governance, Risk and Compliance (CGRC), Certified Internal Auditors (CIA), ISO/IEC 27001 Lead Auditor or Lead Implementer, or GIAC Systems and Network Auditor (GSNA).
• •Experience maintaining and testing against Risk and Control Matrices (RCMs) and framework mappings in partnership with Security Engineering, IT, and Product teams.
• •Strong written and verbal communication skills, with the ability to present testing results, deficiencies, and remediation recommendations to technical and non-technical stakeholders.
• •Understanding of the Three Lines Model and demonstrated experience executing second line control testing, including deficiency evaluation and documentation.
• •Working knowledge of information technology/security general controls – change management, access to programs and data, segregation of duties, asset management, computer operations, encryption practices, and secure systems development – and their relationship to application controls and data integrity.
• •Experience working with GRC technologies.
• •Experience utilizing AI tooling to support core responsibilities accurately and efficiently.
• •Ability to produce documentation suitable for internal and external audit reliance.
• •Sound problem-solving and critical thinking skills, with the ability to manage competing priorities and see assigned work through to completion.
• •Ability to gain and maintain relevant U.S. federal clearances