GRC Analyst

Position : GRC Analyst

Location : Seattle, WA (Hybrid) 4 days a week onsite

Duration : 3 + Months contract 

Responsibilities

• Lead end-to-end privacy impact assessments, including assessments of first- and third-party applications, systems and business processes, and identification of privacy and technological considerations and gaps based on applicable laws, regulations and business requirements
• Evaluate complex privacy risks and document recommended mitigation strategies for partner teams to execute. Collaborate with cross-functional teams to implement effective privacy controls
• Collaborate with Legal, IT, and Cybersecurity teams to ensure privacy controls are aligned and reflect ongoing changes to risk and compliance posture
• Identify opportunities for operational improvements in privacy assessment processes, data mapping tools, and documentation, escalating implementation decisions to leadership as appropriate
• Assist with audit or maturity assessment initiatives
• Respond to and fulfill complex data subject access requests (DSARs)
• Maintain and supplement data mapping and governance documentation
• Support rollout of privacy-enhancing technologies and tools
• Identify and escalate potential privacy risks or threats and recommend mitigation strategies
• Lead incident response processes for privacy-related events

Qualifications

• Education: Bachelor’s degree or master’s in information technology, Computer Science, Cybersecurity or related experience required.
• Experience: 2+ years of privacy or related experience
• Certifications: IAPP certification (CIPP/US, CIPM, or CIPT) strongly preferred
• Skills: Strong working knowledge of Canadian (PIPEDA) and U.S. state-level privacy regulations (CCPA, OCPA, Colorado AI Act, Illinois BIPA) and sectoral privacy laws (e.g. CASL, FCRA, HIPAA, CAN-SPAM, COPPA). Experience with privacy management platforms (e.g. OneTrust, TrustArc). Strong attention to detail, quality and consistency in both written and verbal communications