Senior Governance, Risk & Compliance Analyst

Relativity ODA LLC; United States; Hybrid; USD 110,000 - 150,000; Full time

Job summary

Relativity ODA LLC seeks a Senior Governance, Risk, and Compliance (GRC) Analyst to own assigned control areas and perform integrated IT control testing within the II A Three Lines Model. You will maintain ITGC testing, manage parts of the Risk and Control Matrix, and deliver audit-ready output on schedule.

You will communicate with engineering, product and business teams, translate technical detail into risk terms, and apply common security frameworks to decompose requirements into

Qualifications

• Experience leading IT risk assessment activities.
• Hands-on ITGC testing across systems and processes.
• Ability to design and validate controls to mitigate identified risks.
• Demonstrated audit readiness and ability to produce accurate, timely outputs.
• Strong communication with engineering, product and business teams.
• Fluent with common security frameworks and regulatory guidance.

Responsibilities

• Support and execute second line of defense activities and maintain information security policies.
• Identify risks with defensible analysis and provide remediation recommendations with owners.
• Guide control requirements and ensure alignment with control objectives.
• Monitor control performance and optimize for efficiency and compliance.
• Track deficiencies and drive closure across assigned areas.
• Maintain risk registers and contribute to leadership reporting.

Skills

IT risk assessment

ITGC testing

Control design

Audit readiness

Stakeholder communication

GRC frameworks

Job description

Posting Type

Hybrid/Remote

Job Overview

The Senior Governance, Risk, and Compliance (GRC) Analyst supports second-line assurance for Relativity's control landscape under the Institute of Internal Auditors (IIA) Three Lines Model. They independently own assigned control areas, perform integrated IT control testing, and advise first-line teams on the effective operationalization of controls with periodic oversight from GRC leadership and Staff-level team members. This role is responsible for continuous testing of IT General Controls (ITGC), maintaining assigned portions of Relativity's Risk and Control Matrix (RCM), and delivering accurate, complete and audit-ready output on schedule. Expected to serve as a knowledgeable resource on IT risk assurance and to possess a working command of IT governance, risk and compliance practices.

The following are key to success in this role:

• Strong risk reasoning and decision quality: analyzes and rates risk independently, distinguishes exploitable exposure from theoretical findings, and recommends proportionate treatment with named owners and dates; able to lead analysis of complex or novel scenarios with minimal supervision.
• Working knowledge of IT control design with the technical depth to verify that a control operates where the risk resides rather than accepting its documented presence.
• Proficiency building and operating automated evidence collection and control testing for known systems, replacing manual and screenshot-based evidence with queryable authoritative sources.
• Methodical problem solver who resolves issues creatively and in deliberate sequence - GRC isn't the office of "No," we expand the possibility of "Yes."
• You execute defined priorities with independence and quality, and elevate promptly when work falls outside established patterns.
• You take pride in your work and own outcomes of efforts assigned to you.
• You communicate and negotiate effectively with engineering, product and business counterparts, translating technical detail into risk and business terms and back again without losing accuracy.
• Working fluency in common security frameworks, regulations and industry standards, with the ability to decompose requirements into implementable control language.

Job Description and Requirements

What are the core duties of this role?

Support and execute second line of defense activities. Maintain assigned information security policies and standards aligned to management's control framework, and continuously assess the adequacy and effectiveness of controls placed in operation.

Identify and report risks with defensible, well-reasoned analysis, stating assumptions and confidence; provide gap analyses and remediation recommendations with named owners and dates.

Provide guidance and interpretation on control requirements within assigned control areas, aligned with control objectives.

Monitor control performance and recommend optimization to first line of defense for control rationalization and continued alignment to standards.

Track, report and account for control deficiencies, exceptions, gaps and weaknesses within assigned areas and drive them to closure.

Maintain and update assigned entries in the information security risk register and contribute to quarterly reporting to the CISO and management.

Aggregate and report risk metrics to information security leadership.

Serve as a knowledgeable resource on the nature, timing and extent of IT controls aligned to standardized frameworks. Supports a control environment that enables organizational outcomes and reduces audit lifecycle burden. Operates, monitors and helps optimize the technical control environment within assigned domains. Performs IT risk analysis in alignment with the IT risk appetite and thresholds set by GRC leadership and ERM.

Designs and validates controls for known systems and patterns, applying IT control architecture standards set by senior team members, and favors platform and pipeline enforcement over controls dependent on human diligence.

Partners with engineering and business teams to embed controls that balance assurance, operational burden and technical enablement.

Interprets and applies framework requirements to assigned control domains, identifying where one control satisfies multiple frameworks and distinguishing what a framework requires from convention or preference.

Maintains working fluency in information security standards, benchmarks, frameworks and regulatory guidance, and tracks framework revisions and changes in assessor testing expectations relevant to assigned areas.

Supports internal audit, third line of defense and relevant stakeholders in executing enterprise-wide integrated audits (e.g., SOX, ISO 27001, SOC 2, FedRAMP).

Contributes to periodic analysis of information security's maturation against standards and supports preparation of leadership reporting on security program maturity.

Diagnoses and resolves findings independently across known systems, formin