Senior Governance, Risk & Compliance Analyst

ZipStaff•Austin, TX

1d•Remote

About The Position

ZipStaff is recruiting on behalf of a leading pharmaceutical company for a hands-on Senior Governance, Risk & Compliance (GRC) Analyst. This fully remote assignment focuses on technology risk, regulatory compliance, audit activities, and control programs in complex enterprise environments. The analyst will apply GRC expertise and legal or paralegal document-review experience to interpret contracts, regulatory requirements, legal documents, policies, compliance obligations, and audit materials. The role identifies relevant requirements and potential compliance concerns, and partners with Legal, Privacy, Security, Technology, and business stakeholders when subject-matter review or escalation is needed. The position supports the execution and continuous improvement of the SOX ITGC program and other compliance requirements, including SOC 1, SOC 2, PCI DSS, NIST, FTC, HITRUST, CSI, and DNU. The analyst works with control owners to document and implement controls, gather evidence, prepare for testing, coordinate audits and compliance requests, and track findings and remediation through closure. The role also reviews legal, contractual, regulatory, and compliance materials to identify obligations, deadlines, control requirements, and potential gaps. This is a contract W2 assignment through Randstad. Applicants must be U.S. Citizens or Green Card holders; sponsorship is not available.

Requirements

At least 5 years of experience in GRC, Internal Audit, IT Risk Management, Technology Compliance, regulatory compliance, legal operations, paralegal work, or a related field.
Experience reviewing legal, contractual, regulatory, or compliance documentation and identifying requirements, obligations, risks, or matters requiring escalation.
Experience supporting SOX IT General Controls (ITGC) or comparable control programs, including walkthroughs, testing coordination, evidence review, remediation tracking, or auditor engagement.
Working knowledge of one or more of SOX 302/404, SOC 1, SOC 2, PCI DSS, NIST, HITRUST, FTC requirements, COSO, or COBIT.
Experience partnering with Legal, Compliance, Security, Technology, Internal Audit, external auditors, or business control owners.
Ability to interpret complex written requirements and convert them into organized, actionable documentation.
Strong analytical, research, written communication, and document-management skills.
Strong attention to detail when reviewing contractual, regulatory, audit, and control documentation.
Ability to manage multiple concurrent assignments and deadlines in a complex enterprise environment.
Ability to recognize matters requiring Legal, Privacy, Security, or other subject-matter-expert review and escalate appropriately.
Must be a U.S. Citizen or Green Card holder; sponsorship is not available.
Ability to work fully remotely.

Nice To Haves

Prior experience as a paralegal, senior paralegal, compliance analyst, legal operations analyst, regulatory analyst, or GRC analyst.
Demonstrated experience reviewing contracts, regulatory documents, legal correspondence, policies, audit requests, or compliance obligations.
Experience supporting contract or regulatory obligation management, including identifying requirements related to audit rights, security, privacy, record retention, incident notification, business continuity, or third-party risk.
Experience mapping regulatory or contractual obligations to policies, standards, risks, controls, and evidence.
Knowledge of SOX ITGC and SOC 1/SOC 2 control environments.
Familiarity with COSO, COBIT, NIST, and related governance and control frameworks.
Experience in a first- or second-line-of-defense GRC function.
Experience with enterprise GRC or audit platforms such as ServiceNow GRC/IRM, Archer, AuditBoard, or OneTrust.
Experience researching regulatory requirements and supporting implementation of corresponding policies or controls.
Relevant certifications such as CISA, CRISC, CGRC, CIA, CISM, or paralegal certification.
Bachelor’s degree in Legal Studies, Paralegal Studies, Business Administration, Information Systems, Cybersecurity, Accounting, Finance, Risk Management, or a related discipline, or equivalent professional experience.
Paralegal certificate or demonstrated professional legal-document-review experience.

Responsibilities

Support execution and continuous improvement of the SOX ITGC program and other applicable regulatory and compliance requirements.
Develop, review, maintain, and implement GRC policies, standards, procedures, controls, and supporting documentation.
Review legal, regulatory, contractual, and compliance documents to identify obligations, control and reporting requirements, deadlines, and potential compliance gaps.
Translate relevant requirements into documented compliance requirements and control considerations in partnership with Legal and appropriate subject-matter experts.
Partner with control owners to ensure controls are documented, implemented, supported by evidence, and prepared for testing.
Support MCA testing, Continuity of Business readiness, risk assessments, audit activities, and remediation tracking.
Identify opportunities to improve documentation quality, control consistency, and compliance processes.
Partner with Technology, Security, Legal, Privacy, Internal Audit, external auditors, compliance teams, and business stakeholders.
Coordinate documentation and responses for assigned audit, regulatory, legal, and compliance requests.
Provide practical guidance to control owners on SOX ITGC, SOC requirements, risk management, evidence expectations, and documentation standards.
Review contracts, agreements, addenda, statements of work, regulatory correspondence, policies, procedures, control documentation, audit requests, and other legal or compliance materials for relevant GRC requirements.
Identify and document obligations related to information security, privacy, regulatory compliance, audit rights, record retention, business continuity, third-party risk, incident notification, and controls.
Coordinate walkthroughs, control-testing support, document reviews, evidence collection, and audit response management.
Track findings, remediation plans, regulatory commitments, contractual obligations, and compliance actions through closure.
Provide guidance to junior team members and control owners on GRC processes, evidence requirements, documentation practices, and audit readiness.