Senior Governance, Risk & Compliance Analyst

Posting Type Hybrid/Remote Job Overview The Senior Governance, Risk, and Compliance (GRC) Analyst supports second-line assurance for Relativity’s control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They independently own assigned control areas, perform integrated IT control testing, and advise first-line teams on the effective operationalization of controls with periodic oversight from GRC leadership and Staff-level team members.

This role is responsible for continuous testing of IT General Controls (ITGC), maintaining assigned portions of Relativity’s Risk and Control Matrix (RCM), and delivering accurate, complete and audit-ready output on schedule. Expected to serve as a knowledgeable resource on IT risk assurance and to possess a working command of IT governance, risk and compliance practices. The following are key to success in this role:

• Strong risk reasoning and decision quality: analyzes and rates risk independently, distinguishes exploitable exposure from theoretical findings, and recommends proportionate treatment with named owners and dates; able to lead analysis of complex or novel scenarios with minimal supervision.
• Working knowledge of IT control design with the technical depth to verify that a control operates where the risk resides rather than accepting its documented presence.
• Proficiency building and operating automated evidence collection and control testing for known systems, replacing manual and screenshot-based evidence with queryable authoritative sources.
• Methodical problem solver who resolves issues creatively and in deliberate sequence – GRC isn’t the office of “No,” we expand the possibility of “Yes.”
• You execute defined priorities with independence and quality, and escalate promptly when work falls outside established patterns.
• You take pride in your work and own outcomes of efforts assigned to you.
• You communicate and negotiate effectively with engineering, product and business counterparts, translating technical detail into risk and business terms and back again without losing accuracy.
• Working fluency in common security frameworks, regulations and industry standards, with the ability to decompose requirements into implementable control language.

What are the core duties of this role? Support and execute second line of defense activities. Maintain assigned information security policies and standards aligned to management’s control framework, and continuously assess the adequacy and effectiveness of controls placed in operation. Identify and report risks with defensible, well-reasoned analysis, stating assumptions and confidence; provide gap analyses and remediation recommendations with named owners and dates.

Provide guidance and interpretation on control requirements within assigned control areas, aligned with control objectives. Monitor control performance and recommend optimization to first line of defense for control rationalization and continued alignment to standards. Track, report and account for control deficiencies, exceptions, gaps and weaknesses within assigned areas and drive them to closure. Maintain and update assigned entries in the information security risk register and contribute to quarterly reporting to the CISO and management.

Aggregate and report risk metrics to information security leadership. Serve as a knowledgeable resource on the nature, timing and extent of IT controls aligned to standardized frameworks. Supports a control environment that enables organizational outcomes and reduces audit lifecycle burden. Operates, monitors and helps optimize the technical control environment within assigned domains. Performs IT risk analysis in alignment with the IT risk appetite and…