GRC Analyst III

The GRC Analyst III serves as a lead contributor within the Information Security organization and will help design, build, and mature Reliance’s enterprise Governance, Risk & Compliance program from the ground up. This role will lead day-to-day GRC program execution, including GRC platform implementation, control framework development, policy and exception governance, enterprise risk tracking, compliance evidence management, third-party risk coordination, and executive-ready reporting.

The GRC Analyst III will partner closely with Information Security, IT, Internal Audit, Corporate Risk, Legal, Procurement, business stakeholders, and control owners to establish scalable, repeatable, and audit-defensible processes. This position requires a hands‑on lead who can translate regulatory and security requirements into practical operating procedures, drive accountability across teams, mentor junior contributors, and help create the foundation for a mature, measurable, enterprise-wide GRC capability.

Stand or Sit(Stationary position), Walk(Move, Traverse), Use hand/fingers to handle or feel (Operate, Activate, Use, Prepare, Inspect, Place, Detect, Position), Talk/hear(Communicate, Detect, Converse with, Discern, Convey, Express oneself, Exchange information), See (Detect, Determine, Perceive, Identify, Recognize, Judge, Observe, Inspect, Estimate, Assess), Reaching, Repetitive Motion

Sedentary Work
- Exerting up to 10 pounds of force occasionally, and/or a negligible amount of force frequently or constantly to lift, carry, push, pull or otherwise move objects, including the human body. Sedentary work involves sitting most of the time. Jobs are sedentary if walking and standing are required only occasionally, and all other sedentary criteria are met.

GRC Program Buildout & Leadership – Lead the implementation and operational buildout of Reliance’s enterprise Governance, Risk & Compliance program.

• Help define the target-state GRC operating model, including program processes, roles and responsibilities, intake channels, workflows, reporting expectations, and governance routines.
• Lead configuration, rollout, data quality, and continuous improvement of the GRC platform, including risk registers, control libraries, assessment workflows, issue tracking, exception management, and dashboards.
• Create practical procedures, templates, standards, and operating documentation that allow the GRC program to scale across business units and control owners.

Risk Management & Control Governance – Establish repeatable processes for identifying, assessing, documenting, and reporting information security and compliance risk.

• Lead risk assessments with technical, business, and compliance stakeholders; document risks, control gaps, compensating controls, remediation plans, owners, due dates, and residual risk decisions.
• Develop and maintain risk dashboards, KPIs, KRIs, and leadership reporting that communicate risk posture, remediation progress, exception aging, audit readiness, and control performance.
• Translate findings from assessments, audits, vulnerability reviews, vendor reviews, and security tools into prioritized risk records and action plans.

Policy, Standards & Exception Management – Lead consistent governance practices for policy lifecycle management and risk-based exceptions.

• Coordinate policy and standard review cycles, stakeholder feedback, approvals, publication, acknowledgements, and related evidence.
• Design and operate an exception process covering intake, risk evaluation, documentation, approval routing, renewal cadence, and closure tracking.
• Partner with control owners to ensure exceptions clearly document business need,…