Note: The job is a remote job and is open to candidates in USA. Relativity hires a Senior Governance, Risk & Compliance Analyst to support second-line assurance across its information security control landscape. The role performs IT control testing, maintains risk and control records, advises teams on control design and operation, and supports audits and FedRAMP authorization reviews.

Responsibilities

• Support and execute second line of defense activities
• Maintain assigned information security policies and standards aligned to management’s control framework, and continuously assess the adequacy and effectiveness of controls placed in operation
• Identify and report risks with defensible, well-reasoned analysis, stating assumptions and confidence; provide gap analyses and remediation recommendations with named owners and dates
• Provide guidance and interpretation on control requirements within assigned control areas, aligned to control objectives
• Monitor control performance and recommend optimization to first line of defense for control rationalization and continued alignment to standards
• Track, report and account for control deficiencies, exceptions, gaps and weaknesses within assigned areas and drive them to closure
• Maintain and update assigned entries in the information security risk register and contribute to quarterly reporting to the CISO and management
• Aggregate and report risk metrics to information security leadership
• Serve as a knowledgeable resource on the nature, timing and extent of IT controls aligned to standardized frameworks. Supports a control environment that enables organizational outcomes and reduces audit lifecycle burden. Operates, monitors and helps optimize the technical control environment within assigned domains
• Performs IT risk analysis in alignment with the IT risk appetite and thresholds set by GRC leadership and ERM
• Designs and validates controls for known systems and patterns, applying IT control architecture standards set by senior team members, and favors platform and pipeline enforcement over controls dependent on human diligence
• Partners with engineering and business teams to embed controls that balance assurance, operational burden and technical enablement
• Interprets and applies framework requirements to assigned control domains, identifying where one control satisfies multiple frameworks and distinguishing what a framework requires from convention or preference
• Maintains working fluency in information security standards, benchmarks, frameworks and regulatory guidance, and tracks framework revisions and changes in assessor testing expectations relevant to assigned areas
• Supports internal audit, third line of defense and relevant stakeholders in executing enterprise-wide integrated audits (e.g., SOX, ISO 27001, SOC 2, FedRAMP)
• Contributes to periodic analysis of information security’s maturation against standards and supports preparation of leadership reporting on security program maturity
• Diagnoses and resolves findings independently across known systems, forming and testing hypotheses in deliberate sequence, correlating evidence across sources, and converting resolutions into automated validation so the same finding does not recur
• Represents GRC with engineering, product and business counterparts, securing commitment to remediation from teams outside direct reporting lines; supports GRC and Security management and leadership in executive, customer and auditor forums
• Collaborates cross-organizationally to support SOX readiness initiatives and integrated audits; developing, testing and monitoring controls and identifying opportunities for control homogenization to reduce the organizational cost of controls and detection risk. Reporting periodically to relevant stakeholders on progress, status, exceptions and the associated risk profile
• Support pre-assessment reviews of FedRAMP Moderate and/or High authorization packages aligned to relevant criteria, validating evidence completeness and identifying gaps ahead of external AO and 3PAO review activities

Skills

• 4+ years of professional experience in IT audit, risk management, or compliance, with hands-on ITGC testing experience
• Working knowledge of and experience with risk and control frameworks, including NIST CSF 2.0, NIST 800-53, ISO/IEC 27001, AICPA Trust Services Criteria (SOC 2), COSO, COBIT and/or FedRAMP, including requirement translation and common-control cross-walking
• Advanced-tier GRC certification such as Certified in Risk and Information Systems Control (CRISC), Certified in Governance, Risk and Compliance (CGRC), Certified Internal Auditors (CIA), ISO/IEC 27001 Lead Auditor or Lead Implementer, or GIAC Systems and Network Auditor (GSNA)
• Experience maintaining and testing against Risk and Control Matrices (RCMs) and framework mappings in partnership with Security Engineering, IT, and Product teams
• Strong written and verbal communication skills, with the ability to present testing results, deficiencies, and remediation recommendations to technical and non-technical stakeholders
• Understanding of the Three Lines Model and demonstrated experience executing second line control testing, including deficiency evaluation and documentation
• Working knowledge of information technology/security general controls – change management, access to programs and data, segregation of duties, asset management, computer operations, encryption practices, and secure systems development – and their relationship to application controls and data integrity
• Experience working with GRC technologies
• Experience utilizing AI tooling to support core responsibilities accurately and efficiently
• Ability to produce documentation suitable for internal and external audit reliance
• Sound problem-solving and critical thinking skills, with the ability to manage competing priorities and see assigned work through to completion
• Ability to gain and maintain relevant U.S. federal clearances
• Experience supporting FedRAMP Moderate (or higher) authorization and continuous monitoring activities, and/or Big 4 (or comparable) IT audit experience
• Technical proficiency with a scripting or query language (e.g., Python, PowerShell, SQL, or similar)
• Experience building automated workflows to/from GRC systems to increase process efficiency
• Experience with automated evidence collection or continuous control monitoring tooling
• Experience interacting directly with external auditors or assessors
• Experience providing peer review or guidance to less experienced analysts

Benefits

• Annual performance bonus
• Long-term incentives

Company Overview