Senior Governance, Risk & Compliance Analyst

Relativity•Illinois, IL

1d•$90,000 - $136,000

About The Position

The Senior Governance, Risk, and Compliance (GRC) Analyst supports second-line assurance for Relativity’s control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. The analyst independently owns assigned control areas, performs integrated IT control testing, and advises first-line teams on effective control operations, with periodic oversight from GRC leadership and Staff-level team members. The role continuously tests IT General Controls (ITGC), maintains assigned portions of Relativity’s Risk and Control Matrix (RCM), and delivers accurate, complete, audit-ready work on schedule. It requires a working command of IT governance, risk, and compliance practices and the ability to serve as a knowledgeable resource on IT risk assurance. The analyst assesses risk independently, verifies that controls operate where the risk resides, and recommends proportionate treatments with named owners and dates. The role favors automated evidence collection and testing using authoritative, queryable sources, and works with engineering, product, and business teams to implement controls that balance assurance, operational burden, and technical enablement. The analyst also supports internal audits and third-line stakeholders, enterprise-wide integrated audits, SOX readiness, and pre-assessment reviews of FedRAMP Moderate and/or High authorization packages. This position is listed as Hybrid/Remote. It offers total compensation that includes a base salary, an annual performance bonus, and long-term incentives. The expected salary range is $90,000 to $136,000; the final offer depends on factors including experience, skills, qualifications, and internal pay equity.

Requirements

At least 4 years of professional experience in IT audit, risk management, or compliance, including hands-on ITGC testing.
Working knowledge and experience with risk and control frameworks, including NIST CSF 2.0, NIST 800-53, ISO/IEC 27001, AICPA Trust Services Criteria (SOC 2), COSO, COBIT, and/or FedRAMP, including translating requirements and cross-walking common controls.
An advanced-tier GRC certification such as CRISC, CGRC, CIA, ISO/IEC 27001 Lead Auditor or Lead Implementer, or GIAC Systems and Network Auditor (GSNA).
Experience maintaining and testing against Risk and Control Matrices (RCMs) and framework mappings in partnership with Security Engineering, IT, and Product teams.
Strong written and verbal communication skills, including presenting testing results, deficiencies, and remediation recommendations to technical and non-technical stakeholders.
Understanding of the Three Lines Model and demonstrated experience executing second-line control testing, including deficiency evaluation and documentation.
Working knowledge of IT/security general controls, including change management, access to programs and data, segregation of duties, asset management, computer operations, encryption practices, and secure systems development, and their relationship to application controls and data integrity.
Experience working with GRC technologies.
Experience utilizing AI tooling to support core responsibilities accurately and efficiently.
Ability to produce documentation suitable for internal and external audit reliance.
Sound problem-solving and critical-thinking skills, with the ability to manage competing priorities and see assigned work through to completion.
Ability to gain and maintain relevant U.S. federal clearances.

Nice To Haves

Experience supporting FedRAMP Moderate (or higher) authorization and continuous monitoring activities, and/or Big 4 (or comparable) IT audit experience.
Technical proficiency with a scripting or query language such as Python, PowerShell, or SQL.
Experience building automated workflows to or from GRC systems to increase process efficiency.
Experience with automated evidence collection or continuous control monitoring tooling.
Experience interacting directly with external auditors or assessors.
Experience providing peer review or guidance to less experienced analysts.

Responsibilities

Support and execute second line of defense activities.
Maintain assigned information security policies and standards aligned to management’s control framework, and continuously assess the adequacy and effectiveness of controls in operation.
Identify and report risks with defensible analysis, stated assumptions and confidence; provide gap analyses and remediation recommendations with named owners and dates.
Provide guidance and interpretation on control requirements within assigned control areas, aligned to control objectives.
Monitor control performance and recommend optimization to first-line teams for control rationalization and continued alignment to standards.
Track, report, and account for control deficiencies, exceptions, gaps, and weaknesses within assigned areas, and drive them to closure.
Maintain and update assigned entries in the information security risk register and contribute to quarterly reporting to the CISO and management.
Aggregate and report risk metrics to information security leadership.
Serve as a knowledgeable resource on the nature, timing, and extent of IT controls aligned to standardized frameworks; operate, monitor, and help optimize the technical control environment within assigned domains.
Perform IT risk analysis in alignment with risk appetite and thresholds set by GRC leadership and ERM.
Design and validate controls for known systems and patterns, applying IT control architecture standards and favoring platform and pipeline enforcement over controls dependent on human diligence.
Partner with engineering and business teams to embed controls that balance assurance, operational burden, and technical enablement.
Interpret and apply framework requirements to assigned control domains, identify controls that satisfy multiple frameworks, and distinguish framework requirements from convention or preference.
Maintain working fluency in information security standards, benchmarks, frameworks, and regulatory guidance, and track relevant revisions and changes in assessor testing expectations.
Support internal audit, third-line teams, and relevant stakeholders in enterprise-wide integrated audits, including SOX, ISO 27001, SOC 2, and FedRAMP.
Contribute to periodic analysis of information security program maturity against standards and support leadership reporting on security program maturity.
Diagnose and resolve findings independently across known systems; test hypotheses, correlate evidence across sources, and convert resolutions into automated validation to prevent recurrence.
Represent GRC with engineering, product, and business counterparts, secure remediation commitments from teams outside direct reporting lines, and support management and leadership in executive, customer, and auditor forums.
Collaborate across the organization on SOX readiness and integrated audits; develop, test, and monitor controls; identify opportunities for control homogenization; and report progress, status, exceptions, and associated risk profiles to stakeholders.
Support pre-assessment reviews of FedRAMP Moderate and/or High authorization packages, validate evidence completeness, and identify gaps before external AO and 3PAO reviews.