IT Governance, Risk, and Compliance Analyst
About The Position
RMI is transforming the global energy system to secure a clean, prosperous, zero-carbon future. The IT Governance, Risk, and Compliance Analyst supports the organization's governance, risk, privacy, and compliance program, helping ensure technology systems, vendors, contracts, and business processes align with regulatory requirements and contractual obligations. The role partners closely with Legal, Information Security, IT, the People Team, and Procurement to identify compliance considerations early and strengthen governance and privacy programs. The position maintains technology, privacy, and information-management policies and procedures; supports audits; reviews contracts and business initiatives; coordinates regulatory and contractual compliance programs; and conducts technology and vendor risk assessments. It also supports data governance and privacy through evaluations of technologies and AI solutions, maintenance of data inventories and processing records, and guidance to stakeholders on data handling. The analyst manages cybersecurity awareness training, audits access and IT assets, monitors compliance, and tracks corrective actions through completion. RMI is a remote-ready organization, and this role may be based anywhere in the continental United States. The company provides essential IT equipment, a one-time home technology payment, and a monthly work-from-home/commuter allowance. Occasional travel for in-person meetings is expected, with travel costs covered.
Requirements
- Bachelor's degree in a related field, or equivalent experience, in governance, compliance, risk management, privacy, information security, or business operations.
- 3–5 years of progressively responsible experience in governance, compliance, risk management, privacy, procurement, internal audit, information security, or related functions.
- Experience supporting compliance audits, vendor risk assessments, or regulatory programs, including reviewing contracts and vendor documentation.
- Strong analytical, organizational, and communication skills.
- Strong cross-functional collaboration skills.
Nice To Haves
- Experience with GDPR/UK GDPR, international data transfers, or information governance programs.
- Experience in nonprofit, consulting, research, energy, or other mission-driven organizations.
- One or more certifications: CIPP/US, CIPP/E, CIPM, CIPT, CRISC, or CISA.
Responsibilities
- Maintain governance policies, standards, and procedures for technology, privacy, and information management, and support internal and external audits with evidence and documentation.
- Review contracts and business initiatives for security, privacy, and compliance obligations in partnership with Legal and Procurement.
- Coordinate compliance initiatives, including the Colorado Privacy Act, GDPR/UK GDPR, and other contractual or regulatory programs, and track remediation to completion.
- Conduct risk assessments for new technologies, vendors, and operational changes; maintain the IT risk register and drive mitigation plans to completion.
- Review third-party vendors and subprocessors for security, privacy, and compliance, including DPAs, security questionnaires, and ongoing monitoring.
- Support vendor onboarding and contractual compliance with Legal, Procurement, and Information Security.
- Evaluate new technologies, integrations, and AI solutions for privacy and governance considerations, including against frameworks and regulations such as the NIST AI RMF, ISO/IEC 42001, and EU AI Act.
- Assist with research, testing, and deployment of new AI functionality.
- Maintain data inventories, Records of Processing Activities (ROPAs), classification, retention, and lifecycle documentation.
- Advise stakeholders on appropriate data collection, use, sharing, retention, and protection.
- Manage the monthly cybersecurity awareness training program and support other training activities.
- Perform regular audits of user access, permissions, and IT assets.
- Conduct periodic compliance reviews and governance assessments of systems and processes, and track corrective actions to completion.
- Partner with Infrastructure, Security, Legal, the People Team, and Procurement to embed governance requirements early in technology projects.
Benefits
- Medical, dental, and vision insurance.
- 403(b) retirement match with immediate vesting.
- Group life, AD&D, and short- and long-term disability coverage.
- Optional voluntary life, AD&D, and accident plans.
- Health savings or flexible spending accounts.
- Fertility and hormonal health support.
- Mental health and wellness support.
- Comprehensive leaves of absence, including generous parental leave.
- Generous paid time off and sick leave.
- Paid sabbatical leave.
- Regional holidays with at least one extended break in each geography.
- Work-from-home and home technology allowances.
- Learning and development opportunities, including LinkedIn Learning and an annual individual professional development budget.
- Potential for bonuses and merit increases.
- Discount marketplace, including gym memberships and pet insurance.
- Hybrid/remote work options.
- Team retreats and geographic meetups.
- Rewards and recognition programs.
- Occasional work travel costs are covered.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
