Data Governance Analyst

Smartsuite; Newport Beach (CA); On-site; USD 110,000 - 140,000; Full time

Job summary

Capitolis seeks a Data Governance Analyst to oversee data quality, metadata, and processing integrity across systems and vendors. You will maintain records of processing activities and data flows, ensuring inventories align with privacy requirements and provide accurate data for privacy reporting.

You will collaborate with Privacy, Security, and AI governance teams to map data lineage, support DPIAs, and keep ROPA and dashboards current for governance and risk management.

Qualifications

• Experience shaping data governance programs and policy
• Ability to map data lineage and maintain processing records
• Familiarity with privacy regulations and DPIA requirements

Responsibilities

• Maintain records of processing activities and data flows across systems and vendors
• Keep system and vendor inventories current and aligned with privacy requirements
• Monitor data quality and metadata standards across data assets
• Support data classification, retention rules and privacy reporting
• Supply accurate data for privacy dashboards and disclosures
• Collaborate with Privacy, Security, and AI Governance teams to ensure data assets are well-governed

Skills

Data governance

Data quality

Privacy

Metadata management

Risk assessment

Tools

SmartSuite

Job description

Governance, risk and compliance

SmartSuite for the Data Governance Analyst

The Data Governance Analyst manages data quality, metadata and processing integrity across systems and vendors. They maintain records of processing activities and data flows, keep system and vendor inventories aligned with privacy requirements and supply accurate data for privacy reporting.

What you own

The Data Governance Analyst manages data quality, metadata and processing integrity across systems and vendors.

• Maintain records of processing activities and data flow maps
• Keep system and vendor inventories current
• Monitor data quality and metadata standards
• Support data classification and retention rules
• Supply accurate data for privacy dashboards and disclosures
• Support data stewardship across business units

At a glance

The GRC processes this role owns, touches and depends on.

Owns

accountable for the process

Privacy

Touches

contributes or approves

Reporting Compliance management

Depends on

consumes its output

Policy management

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the Data Governance Analyst: navy is owned, blue is touched, grey is depended on.

1. First line The business and its control owners Run the processes, own the controls, fix the issues
2. Second line Risk, compliance and the domain programmes Set the frameworks, assess, monitor and advise
3. Third line Internal audit Independent assurance to the board and audit committee

Owns Touches Depends on Other processes

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Privacy Program Manager

Works closely with

Privacy Analyst

Information Security Officer

AI Governance Lead

How SmartSuite supports the Data Governance Analyst

The Data Governance Analyst keeps the records of processing, data flows and inventories that privacy and AI governance depend on, answerable to the Privacy Program Manager and the Chief Data and AI Officer. SmartSuite holds those registers as linked records with owners and history, so a change in one place is visible everywhere it matters.

Keep processing records, flows and inventories current

Data flow maps across systems and vendors

Map each processing activity to the systems, vendors and regions the data passes through, so the lineage behind a ROPA entry is a set of linked records rather than a diagram that drifts out of date.

Owners assigned to every processing activity

Each processing activity and system record carries a named owner and a review date, with reminders when confirmation is due, so stewardship across business units is visible instead of assumed.

Data categories and retention held with the record

Record data categories and the retention schedule against each processing activity and system, linked to the policy and control that require them, so the Information Security Officer and you work from the same definitions.

Connect to privacy, security, vendors and AI governance

Vendor records linked to the data they process

Each vendor is linked to the processing activities and data categories it handles, so when the Privacy Analyst assesses a supplier the data lineage is already attached to the record.

Data quality issues traced to the models

Models are linked to the datasets they rely on, so when you log a data quality or metadata issue against a dataset, the AI Governance Lead and model owners can see which models it touches before a review finds it.

DPIAs that start from the inventory

When the Privacy Analyst runs a DPIA, the processing record, data flows and vendors you maintain are pulled into the assessment, so it starts from current facts rather than a fresh questionnaire.

Supply numbers regulators and dashboards can trust

Article 30 records ready for the regulator

The ROPA is complete, searchable and linked to legal bases and controls, so a regulator's request under GDPR Article 30 is answered from the register rather than from a reconstruction.

Inventory coverage on a dashboard

Dashboards count processing activities, systems and vendors by owner and review date, so the Privacy Program Manager sees which records are unconfirmed instead of waiting for an audit to find them.

Review history for every inventory change

Every change to a processing record, system entry or vendor link is logged with who, when and why, giving the Chief Data and AI Officer an audit trail for BCBS 239 or SOC 2 questions.

Privacy. Provides structured inventories with ROPA records, system inventories and vendor linkage for data lineage visibility.

AI governance. Links data sets and systems to the AI models that use them in the model registry.

Reporting. Supplies accurate data for privacy dashboards and disclosures.

Products this role uses most

Privacy Risk Management

Manage privacy risks with data inventories, PIAs and DPIAs, control tracking, and dashboards that show exposure against GDPR, CCPA, and HIPAA requirements.

AI Governance

Track AI models, assess risk, and document compliance across your enterprise in one platform.

Configuration Management (CMDB)

Track systems, applications, and dependencies in a CMDB that feeds incident, change, and service workflows.

Industry reference

The DAMA DMBOK defines the data governance practice: ownership, quality rules, metadata and lineage. GDPR Article 30 requires accurate records of processing and the NIST Privacy Framework asks for a data inventory and mapping, so the analyst's registers are compliance records as well as data assets.

Sector expectations are specific. Banks must meet BCBS 239 principles for risk data aggregation and reporting; healthcare organizations maintain HIPAA-compliant data inventories and minimum-necessary rules; US federal agencies follow the Evidence Act and OMB data governance requirements; technology companies map data flows for SOC 2 confidentiality criteria and privacy obligations.

Related roles

Privacy Program Manager

Explore Further

Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.

Frequently asked questions

The Data Governance Analyst manages data quality, metadata and processing integrity across systems and vendors. In practice that means maintaining the records of processing activities and data flow maps, keeping the system and vendor inventories current, monitoring data quality and metadata standards, supporting classification and retention rules and supplying accurate data for privacy dashboards and disclosures. Under GDPR Article 30 and the NIST Privacy Framework those registers are compliance records as well as data assets, so accuracy is the job.

Privacy Risk Management provides structured inventories: ROPA records, system inventories and vendor linkage, connected so the analyst can see data lineage from the processing activity to the systems that hold the data and the vendors that touch it. Instead of a ROPA spreadsheet that drifts from the system list, each record references the others, and a change to a vendor or system shows up in the processing activities that depend on it. The Privacy Analyst works the same records when assessing new processing.

AI Governance links data sets and systems to the AI models that use them in the model registry, so the Data Governance Analyst can answer which models are trained on or consume a given data set and whether that use is covered by the processing records. The AI Governance Lead maintains the model side of the registry while the analyst maintains the data side, and the link between them is what an AI impact assessment or a regulator's question about training data needs.

Configuration Management (CMDB) holds the configuration items and their relationships that IT maintains, and the privacy system inventory can reference the same records rather than describing the estate a second time. For the Data Governance Analyst that means the systems named in a processing record are the systems IT recognizes, and the Information Security Officer sees the same list when assessing a system's safeguards. Keeping the inventories aligned removes the usual reconciliation between privacy's list and IT's list.

SmartSuite supplies accurate data for privacy dashboards and disclosures from the inventories the analyst maintains, so the Privacy Program Manager and the Chief Data and AI Officer report from the registers rather than from figures collected for the occasion. Counts of processing activities, systems, vendors and data categories come from the records themselves, and a disclosure or a data map for a regulator draws on the same source. That is also what BCBS 239 expects of risk data in banks.

Most teams start with the ROPA spreadsheet, the application list IT already keeps and the vendor list from procurement or third-party risk, and load those as the first inventories. Once the three are linked, the analyst can see which processing activities lack a system or vendor reference and work through the gaps, which is usually where data quality improves first. Data flow maps and classification rules follow as the inventories settle, and the AI model links are added as the registry fills.