Senior Governance, Risk & Compliance Analyst

Legal & Regulatory Compliance Focus

You are a hands-on Governance, Risk, and Compliance (GRC) professional with experience supporting technology risk, regulatory compliance, audit activities, and control programs within complex enterprise environments.

You bring a combination of GRC expertise and legal or paralegal experience, enabling you to review and interpret contracts, regulatory requirements, legal documents, policies, compliance obligations, and audit materials. You can identify relevant requirements, flag potential compliance concerns, and partner with Legal, Privacy, Security, Technology, and business stakeholders when legal interpretation or escalation is required.

You understand risk and control frameworks such as SOX IT General Controls (ITGC), SOC 1, SOC 2, PCI DSS, NIST, and related regulatory requirements. You are comfortable reviewing controls and supporting evidence, documenting findings, tracking remediation activities, and helping teams remain prepared for audits and regulatory reviews.

As a Senior-level individual contributor, you independently manage assigned compliance and risk activities, apply sound judgment to complex documentation, and escalate significant legal, regulatory, control, or risk issues to the appropriate subject matter experts.

You are detail-oriented, organized, and able to translate complex legal, regulatory, technical, and compliance language into clear requirements and actionable guidance.

Role Responsibilities Development & Enforcement

• Support the execution and continuous improvement of the organization's SOX ITprogram, with additional support for SOC 1, SOC 2, PCI DSS, NIST, FTC, HITRUST, CSI, DNU, and other applicable regulatory or compliance requirements.
• Support the development, review, maintenance, and implementation of GRC policies, standards, procedures, controls, and supporting documentation.
• Review legal, regulatory, contractual, and compliance documentation to identify obligations, control requirements, reporting requirements, deadlines, and potential compliance gaps.
• Translate relevant legal, contractual, and regulatory requirements into documented compliance requirements and control considerations in partnership with Legal and appropriate subject matter experts.
• Partner with control owners to ensure assigned controls are appropriately documented, implemented, supported by evidence, and prepared for testing.
• Support Governance, Risk, and Control activities including MCA testing, Continuity of Business readiness, risk assessments, audit support, and remediation tracking.
• Identify opportunities to improve documentation quality, control consistency, and compliance processes.

Collaboration & Expertise

• Partner with Technology, Security, Legal, Privacy, Internal Audit, external auditors, compliance teams, and business stakeholders.
• Act as a liaison for assigned audit, regulatory, legal, and compliance requests, helping coordinate documentation and responses across stakeholders.
• Provide practical guidance to control owners regarding SOX IT SOC requirements, risk management practices, evidence expectations, and documentation standards.
• Work with Legal and other subject matter experts to clarify regulatory or contractual requirements when interpretation extends beyond the scope of the GRC role.
• Support stakeholders in understanding how regulatory, contractual, and compliance obligations translate into operational processes and controls.
• Communicate identified risks and compliance concerns clearly and escalate material issues appropriately.

Legal & Regulatory Document Review

• Review contracts, agreements, addenda, statements of work, regulatory correspondence, policies, procedures, control documentation, audit requests, and other legal or compliance-related materials for relevant GRC requirements.
• Identify and document obligations related to information security, privacy, regulatory compliance, audit rights, record retention, business continuity, third-party risk, breach or incident notification, and control requirements.
• Compare contractual and regulatory requirements against existing policies, processes, and controls to identify potential gaps requiring further review.
• Support Legal and business stakeholders by organizing requirements, maintaining obligation inventories, and tracking compliance commitments.
• Assist with reviewing proposed changes to policies, standards, contractual language, and compliance documentation for consistency with established governance and control requirements.
• Maintain clear documentation and traceability between source requirements, internal controls, supporting evidence, and remediation activities.
• Recognize issues requiring formal legal interpretation and escalate those matters to Legal rather than independently providing legal advice.

Analysis & Configuration

• Evaluate IT controls and supporting documentation to identify potential control gaps, documentation weaknesses, or remediation needs.
• Review audit evidence for completeness, accuracy, consistency, and alignment with documented control requirements.
• Perform control gap assessments and risk assessments using established GRC methodologies.
• Analyze audit findings, regulatory requirements, legal obligations, and control performance to identify recurring issues or improvement opportunities.
• Assist with root-cause analysis and documentation of control deficiencies and compliance issues.
• Support maintenance and configuration of GRC platforms, audit management systems, risk registers, control libraries, and compliance tracking tools.
• Maintain mappings among regulatory requirements, contractual obligations, policies, risks, controls, and evidence where applicable.

Operational Support

• Coordinate day-to-day compliance activities, including walkthroughs, control testing support, document reviews, evidence collection, and audit response management.
• Support Internal Audit, external auditor, Legal, regulatory, and compliance information requests.
• Draft and review audit and compliance responses to help ensure they are accurate, complete, well-supported, and consistent with available documentation.
• Coordinate the collection and review of supporting documentation for audits and examinations.
• Track findings, remediation plans, regulatory commitments, contractual obligations, and compliance actions through closure.
• Maintain accurate GRC records and provide clear status reporting to stakeholders.
• Escalate missed deadlines, documentation deficiencies, control issues, or material compliance risks.

Mentorship & Training

• Provide guidance to junior team members and control owners on GRC processes, evidence requirements, documentation practices, and audit readiness.
• Share best practices for reviewing compliance documentation and maintaining defensible records.
• Assist with developing training materials, procedures, templates, checklists, playbooks, and other GRC guidance.
• Support consistent application of risk assessment and compliance methodologies across assigned workstreams.
• Provide peer review of GRC documentation and work products, as appropriate.

Innovation & Research

• Monitor changes to relevant regulatory requirements, industry standards, contractual requirements, and audit expectations.
• Research emerging risk and compliance requirements and summarize potential impacts for GRC, Legal, Security, Technology, and business stakeholders.
• Identify opportunities to standardize or automate evidence collection, requirements tracking, control mapping, and compliance reporting.
• Recommend practical improvements to documentation and workflows that reduce manual effort and strengthen audit defensibility.

Strategic Planning

• Support GRC leadership in identifying risk themes, control gaps, regulatory obligations, and program improvement opportunities.
• Contribute to audit and compliance planning based on assigned risks and requirements.
• Support prioritization of remediation activities using established risk and compliance criteria.
• Provide analysis and documentation that enables more senior GRC, Legal, Security, and business leaders to make informed risk decisions.
• Contribute to the continued maturity of the organization's governance, risk, control, and compliance environment.

Qualifications Basic Qualifications

• 5+ years of experience in Governance, Risk & Compliance, Internal Audit, IT Risk Management, Technology Compliance, regulatory compliance, legal operations, paralegal work, or a related field.
• Experience reviewing legal, contractual, regulatory, or compliance documentation and identifying relevant requirements, obligations, risks, or areas requiring escalation.
• Experience supporting SOX IT General Controls (ITGC) or comparable control programs, including walkthroughs, testing coordination, evidence review, remediation tracking, or auditor engagement.
• Working knowledge of one or more frameworks or regulatory areas such as SOX 302/404, SOC 1, SOC 2, PCI DSS, NIST, HITRUST, FTC requirements, COSO, or COBIT.
• Experience partnering with Legal, Compliance, Security, Technology, Internal Audit, external auditors, or business control owners.
• Ability to interpret complex written requirements and convert those requirements into organized, actionable documentation.
• Strong analytical, research, written communication, and document-management skills.
• Strong attention to detail, particularly when reviewing contractual, regulatory, audit, and control documentation.
• Ability to manage multiple concurrent assignments and deadlines in a complex enterprise environment.
• Ability to recognize matters requiring Legal, Privacy, Security, or other subject-matter-expert review and escalate appropriately.

Preferred Qualifications

• Prior experience as a paralegal, senior paralegal, compliance analyst, legal operations analyst, regulatory analyst, or GRC analyst.
• Demonstrated experience reviewing contracts, regulatory documents, legal correspondence, policies, audit requests, or compliance obligations.
• Experience supporting contract or regulatory obligation management, including identifying requirements related to audit rights, security, privacy, record retention, incident notification, business continuity, or third-party risk.
• Experience mapping regulatory or contractual obligations to policies, standards, risks, controls, and evidence.
• Knowledge of SOX ITand SOC 1 / SOC 2 control environments.
• Familiarity with COSO, COBIT, NIST, and related governance and control frameworks.
• Experience operating within a first or second line of defense GRC function.
• Experience with enterprise GRC or audit platforms such as ServiceNow GRC/IRM, Archer, AuditBoard, or OneTrust.
• Experience researching regulatory requirements and supporting the implementation of corresponding policies or controls.
• Relevant certifications such as CISA, CRISC, CGRC, CIA, CISM, or paralegal certification are preferred.

Education

• Bachelor's degree in Legal Studies, Paralegal Studies, Business Administration, Information Systems, Cybersecurity, Accounting, Finance, Risk Management, or a related discipline, or equivalent professional experience.
• Paralegal certificate or demonstrated professional legal-document-review experience preferred.
• Relevant GRC, audit, security, risk, or compliance certifications such as CISA, CRISC, CGRC, CIA, or CISM are preferred.