Senior Analyst-GRC

Description

Who we are: BAL is a team of brilliant people who change lives through elite immigration work and collaborative innovation. We pursue the exceptional in all that we do, but never at the expense of our values. There’s no denying our work is demanding, both in volume and pace, but we’re up for the challenge. We love the balance of hard work and fun – so, you’ll see us in jeans as we shatter glass ceilings and conventional stereotypes.

BAL employees feel valued, rewarded, and respected. We seek opportunities to be of service to others and our communities. We are committed to your growth and development, and want to set you up for success here at BAL and beyond.

Who you are: You are looking for work that has a purpose. You aren’t afraid to roll up your sleeves and get stuff done. You learn quickly. You move fast. You embrace challenge and detail as well as creative thinking. You believe you have something unique to contribute and you aren’t afraid to raise your hand. You understand that powering human achievement is ultimately about impacting a real person.

You are looking for a place to grow and an environment where everyone has a spot and is genuinely welcome.

We’re better together: A bright, driven person like you and an industry-leading powerhouse like BAL? It’s a perfect combination! We truly want to see you succeed here and become an integral part of our mission to provide an experience that makes a positive difference in people’s lives. Come be a part of something special, where you can have an impact and be valued just for being you!

In addition to competitive pay, a discretionary annual bonus, and a supportive, team oriented culture, we offer an outstanding benefits package that includes medical, dental, vision, disability, and life insurance, sick time, unlimited vacation, and 401(k) with company match.

PRIMARY RESPONSIBILITIES:

• Leads and performs internal audits using a risk-based methodology; assess IT, Info Sec, Privacy, and AI-related controls and processes; develops and executes audit plans, manages and prioritizes findings based on risk ratings, and tracks corrective action plans to closure.
• Supports the ongoing management and improvement of BAL’s Information Security Management System (ISMS) and Privacy Information Management System (PIMS) to maintain compliance and certification with ISO standards 27001 and 27701.
• Supports privacy program operations including Records of Processing Activities maintenance, Data Protection Impact Assessments (DPIAs), and Data Subject Access Request (DSAR).
• Supports the expansion and ongoing management of BAL’s AI governance framework, including leading risk assessments of AI tools and use cases against applicable regulatory frameworks (e.g., EU AI Act), development and maintenance of AI acceptable use policies, creation and maintenance of an AI system inventory, and the development of AI specific vendor due diligence criteria.
• Supports the Third-Party Risk Management (TPRM) program by performing risk-tiered vendor assessments, security and privacy due diligence reviews, maintaining the vendor risk register, and escalating findings to appropriate stakeholders.
• Serves as the primary operator of BAL’s data loss prevention (DLP) tools, managing alert queues, refining detection policies and works with the Sec Ops team to review and elevate security operations alerts and vulnerabilities to ensure timely remediation.
• Supports review and response for Security Operations, and Privacy exposure events (incident response).
• Owns and maintains BAL’s Business Continuity and Disaster Recovery (BC/DR) program, including plan documentation, scheduled testing and tabletop exercises, gap identification and remediation tracking, and periodic reporting to firm leadership on program status and maturity.
• Development and management of BAL’s GRC metrics and reporting, including defining Key Performance Indicators (KPIs) and Key Risk Indicators (KRIs) across Information Security, Privacy, and AI governance domains.
• Supports the development and ongoing management of BAL's data governance program, including data classification, data inventory and mapping, records retention…