GRC Analyst

Reltio

8d

About The Position

The GRC Analyst prepares timely, accurate responses to customer security, privacy, compliance, and AI governance questionnaires and inquiries, coordinating with internal subject matter experts to verify responses and gather supporting documentation. The role maintains reusable questionnaire responses and customer-facing compliance materials, and responds to ad-hoc requests for audit reports, certifications, policies, and control evidence. It escalates complex or high-risk inquiries and tracks trends that may reveal documentation or control gaps.

The analyst executes third-party risk assessments throughout the vendor lifecycle, maintains vendor inventories and risk tiers, reviews security and privacy documentation, identifies risks, and tracks remediation with business owners. The position also supports GDPR-related requests by collecting information, maintaining records, tracking deadlines, and coordinating with Legal, Privacy, and other stakeholders.

The role develops working knowledge of SAP governance processes and supports a range of GRC activities, including audit preparation, evidence collection, policy reviews, risk assessments, compliance training, access reviews, issue tracking, risk register maintenance, compliance monitoring, security awareness tracking, and GRC tooling administration. The analyst keeps documentation organized, communicates progress and blockers, looks for process improvements, and communicates clearly with customers, vendors, and internal stakeholders.

Requirements

• Bachelor’s degree in information systems, cybersecurity, business, accounting, or a related field, or equivalent practical experience.
• At least two years of relevant experience in governance, risk, and compliance; information security; privacy; audit; or third-party risk management.
• Experience preparing customer security or compliance questionnaire responses and reviewing vendor security and privacy documentation.
• Working knowledge of common security and compliance frameworks and familiarity with GDPR concepts and privacy request workflows.
• Experience working in or supporting a cloud, enterprise software, or SaaS environment, with an understanding of shared security responsibilities.
• Strong written and verbal communication skills, including the ability to translate technical information into clear, accurate responses.
• Strong attention to detail, sound judgment, and ability to manage multiple requests, meet deadlines, and follow through on outstanding items.
• Ability to collaborate across Security, Legal, Privacy, Product, Engineering, Sales, Procurement, and other business functions.
• Proficiency with documentation tools and ticketing or workflow systems, and ability to learn new tools and internal processes.

Nice To Haves

• Prior experience within SAP or familiarity with SAP’s internal privacy, vendor management, policy management, and compliance processes.
• Familiarity with Master Data Management (MDM) platforms and related enterprise data security and privacy considerations.
• Experience with trust centers, questionnaire management tools, Jira, ServiceNow, or Confluence.
• Experience supporting audits or assessments involving SOC 1, SOC 2, ISO 27001, HITRUST CSF, or privacy frameworks.
• Familiarity with AI governance, AI risk assessments, or customer AI questionnaires.
• Relevant certifications such as CISA, CRISC, Security+, CIPP, CIPM, or equivalent credentials.

Responsibilities

• Prepare accurate, timely responses to customer security, privacy, compliance, and AI governance questionnaires and inquiries.
• Coordinate with internal subject matter experts to validate responses and gather supporting documentation.
• Maintain reusable questionnaire responses and customer-facing compliance materials.
• Respond to customer requests for audit reports, certifications, policies, and control evidence; escalate complex or high-risk inquiries and track trends that may reveal gaps.
• Execute third-party risk assessments across vendor intake, due diligence, onboarding, periodic review, and offboarding.
• Maintain the vendor inventory and risk tiering; review vendor security and privacy documentation, identify potential risks, and track remediation activities with business owners.
• Maintain vendor assessment records and coordinate initial reviews, periodic reassessments, and follow-up activities.
• Support GDPR-related requests by gathering information, maintaining request records, tracking deadlines, and coordinating responses with Legal, Privacy, and other stakeholders.
• Develop and maintain working knowledge of SAP privacy, vendor management, policy management, and related governance processes; help the GRC team identify process owners and coordinate submissions and approvals.
• Support audit preparation, evidence collection, policy reviews, risk assessments, compliance training, access reviews, and issue tracking.
• Maintain accurate documentation, communicate progress and blockers, and identify opportunities to simplify and improve GRC processes.
• Communicate technical and regulatory requirements clearly to customers, vendors, and internal stakeholders.
• Support risk register maintenance, compliance monitoring, security awareness and training tracking, issue management, and GRC tooling administration.

What This Job Offers

• Job Type: Full-time
• Career Level: Entry Level