Senior Governance, Risk & Compliance Analyst

Job Description
A hands-on Governance Risk and Compliance (GRC) professional with experience supporting technology risk regulatory compliance audit activities and control programs within complex enterprise environments.
You bring a combination of GRC expertise and legal or paralegal experience enabling you to review and interpret contracts regulatory requirements legal documents policies compliance obligations and audit materials. You can identify relevant requirements flag potential compliance concerns and partner with Legal Privacy Security Technology and business stakeholders when legal interpretation or escalation is required.
You understand risk and control frameworks such as SOX IT General Controls (ITGC) SOC 1 SOC 2 PCI DSS NIST and related regulatory requirements. You are comfortable reviewing controls and supporting evidence documenting findings tracking remediation activities and helping teams remain prepared for audits and regulatory reviews.
As a Senior-level individual contributor you independently manage assigned compliance and risk activities apply sound judgment to complex documentation and escalate significant legal regulatory control or risk issues to the appropriate subject matter experts.
You are detail-oriented organized and able to translate complex legal regulatory technical and compliance language into clear requirements and actionable guidance.
Development & Enforcement
Support the execution and continuous improvement of the organizations SOX ITGC program with additional support for SOC 1 SOC 2 PCI DSS NIST FTC HITRUST CSI DNU and other applicable regulatory or compliance requirements.
Support the development review maintenance and implementation of GRC policies standards procedures controls and supporting documentation.
Review legal regulatory contractual and compliance documentation to identify obligations control requirements reporting requirements deadlines and potential compliance gaps.
Translate relevant legal contractual and regulatory requirements into documented compliance requirements and control considerations in partnership with Legal and appropriate subject matter experts.
Partner with control owners to ensure assigned controls are appropriately documented implemented supported by evidence and prepared for testing.
Support Governance Risk and Control activities including MCA testing Continuity of Business readiness risk assessments audit support and remediation tracking.
Identify opportunities to improve documentation quality control consistency and compliance processes.
Collaboration & Expertise
Partner with Technology Security Legal Privacy Internal Audit external auditors compliance teams and business stakeholders.
Act as a liaison for assigned audit regulatory legal and compliance requests helping coordinate documentation and responses across stakeholders.
Provide practical guidance to control owners regarding SOX ITGC SOC requirements risk management practices evidence expectations and documentation standards.
Work with Legal and other subject matter experts to clarify regulatory or contractual requirements when interpretation extends beyond the scope of the GRC role.
Support stakeholders in understanding how regulatory contractual and compliance obligations translate into operational processes and controls.
Communicate identified risks and compliance concerns clearly and escalate material issues appropriately.
Legal & Regulatory Document Review
Review contracts agreements addenda statements of work regulatory correspondence policies procedures control documentation audit requests and other legal or compliance-related materials for relevant GRC requirements.
Identify and document obligations related to information security privacy regulatory compliance audit rights record retention business continuity third-party risk breach or incident notification and control requirements.
Compare contractual and regulatory requirements against existing policies processes and controls to identify potential gaps requiring further review.
Support Legal and business stakeholders by organizing requirements maintaining obligation inventories and tracking compliance commitments.
Assist with reviewing proposed changes to policies standards contractual language and compliance documentation for consistency with established governance and control requirements.
Maintain clear documentation and traceability between source requirements internal controls supporting evidence and remediation activities.
Recognize issues requiring formal legal interpretation and escalate those matters to Legal rather than independently providing legal advice.
Analysis & Configuration
Evaluate IT controls and supporting documentation to identify potential control gaps documentation weaknesses or remediation needs.
Review audit evidence for completeness accuracy consistency and alignment with documented control requirements.
Perform control gap assessments and risk assessments using established GRC methodologies.
Analyze audit findings regulatory requirements legal obligations and control performance to identify recurring issues or improvement opportunities.
Assist with root-cause analysis and documentation of control deficiencies and compliance issues.
Support maintenance and configuration of GRC platforms audit management systems risk registers control libraries and compliance tracking tools.
Maintain mappings among regulatory requirements contractual obligations policies risks controls and evidence where applicable.
Operational Support
Coordinate day-to-day compliance activities including walkthroughs control testing support document reviews evidence collection and audit response management.
Support Internal Audit external auditor Legal regulatory and compliance information requests.
Draft and review audit and compliance responses to help ensure they are accurate complete well-supported and consistent with available documentation.
Coordinate the collection and review of supporting documentation for audits and examinations.
Track findings remediation plans regulatory commitments contractual obligations and compliance actions through closure.
Maintain accurate GRC records and provide clear status reporting to stakeholders.
Escalate missed deadlines documentation deficiencies control issues or material compliance risks.
Mentorship & Training
Provide guidance to junior team members and control owners on GRC processes evidence requirements documentation practices and audit readiness.
Share best practices for reviewing compliance documentation and maintaining defensible records.
Assist with developing training materials procedures templates checklists playbooks and other GRC guidance.
Support consistent application of risk assessment and compliance methodologies across assigned workstreams.
Provide peer review of GRC documentation and work products as appropriate.
Innovation & Research
Monitor changes to relevant regulatory requirements industry standards contractual requirements and audit expectations.
Research emerging risk and compliance requirements and summarize potential impacts for GRC Legal Security Technology and business stakeholders.
Identify opportunities to standardize or automate evidence collection requirements tracking control mapping and compliance reporting.
Recommend practical improvements to documentation and workflows that reduce manual effort and strengthen audit defensibility.
Strategic Planning
Support GRC leadership in identifying risk themes control gaps regulatory obligations and program improvement opportunities.
Contribute to audit and compliance planning based on assigned risks and requirements.
Support prioritization of remediation activities using established risk and compliance criteria.
Provide analysis and documentation that enables more senior GRC Legal Security and business leaders to make informed risk decisions.
Contribute to the continued maturity of the organizations governance risk control and compliance environment.
Job Responsibilities
Basic Qualifications
5 years of experience in Governance Risk & Compliance Internal Audit IT Risk Management Technology Compliance regulatory compliance legal operations paralegal work or a related field.
Experience reviewing legal contractual regulatory or compliance documentation and identifying relevant requirements obligations risks or areas requiring escalation.
Experience supporting SOX IT General Controls (ITGC) or comparable control programs including walkthroughs testing coordination evidence review remediation tracking or auditor engagement.
Working knowledge of one or more frameworks or regulatory areas such as SOX 302/404 SOC 1 SOC 2 PCI DSS NIST HITRUST FTC requirements COSO or COBIT.
Experience partnering with Legal Compliance Security Technology Internal Audit external auditors or business control owners.
Ability to interpret complex written requirements and convert those requirements into organized actionable documentation.
Strong analytical research written communication and document-management skills.
Strong attention to detail particularly when reviewing contractual regulatory audit and control documentation.
Ability to manage multiple concurrent assignments and deadlines in a complex enterprise environment.
Ability to recognize matters requiring Legal Privacy Security or other subject-matter-expert review and escalate appropriately.
Preferred Qualifications
Prior experience as a paralegal senior paralegal compliance analyst legal operations analyst regulatory analyst or GRC analyst.
Demonstrated experience reviewing contracts regulatory documents legal correspondence policies audit requests or compliance obligations.
Experience supporting contract or regulatory obligation management including identifying requirements related to audit rights security privacy record retention incident notification business continuity or third-party risk.
Experience mapping regulatory or contractual obligations to policies standards risks controls and evidence.
Knowledge of SOX ITGC and SOC 1 / SOC 2 control environments.
Familiarity with COSO COBIT NIST and related governance and control frameworks.
Experience operating within a first or second line of defense GRC function.
Experience with enterprise GRC or audit platforms such as ServiceNow GRC/IRM Archer AuditBoard or OneTrust.
Experience researching regulatory requirements and supporting the implementation of corresponding policies or controls.
Relevant certifications such as CISA CRISC CGRC CIA CISM or paralegal certification are preferred.
Education
Bachelors degree in Legal Studies Paralegal Studies Business Administration Information Systems Cybersecurity Accounting Finance Risk Management or a related discipline or equivalent professional experience.
Paralegal certificate or demonstrated professional legal-document-review experience preferred.
Relevant GRC audit security risk or compliance certifications such as CISA CRISC CGRC CIA or CISM are preferred.

Required Skills:

CISMTESTING