GRC Analyst

Plays a critical role in advancing the company’s privacy program to ensure compliance with applicable privacy laws, company policies and standards, and industry best practices. Leads privacy projects, working independently and collaborating closely with business and IT teams, escalating when situations require senior input to ensure proper controls are identified and risks escalated to support compliance with privacy laws.

Data Analyst + Program Management Responsibility. Supporting the privacy assessment process at Client

• Lead end-to-end privacy impact assessments, including assessments of first- and third-party applications, systems and business processes, and identification of privacy and technological considerations and gaps based on applicable laws, regulations and business requirements
• Evaluate complex privacy risks and document recommended mitigation strategies for partner teams to execute. Collaborate with cross-functional teams to implement effective privacy controls
• Collaborate with Legal, IT, and Cybersecurity teams to ensure privacy controls are aligned and reflect ongoing changes to Client’s risk and compliance posture
• Identify opportunities for operational improvements in privacy assessment processes, data mapping tools, and documentation, escalating implementation decisions to leadership as appropriate
• Assist with audit or maturity assessment initiatives
• Respond to and fulfill complex data subject access requests (DSARs)
• Maintain and supplement data mapping and governance documentation
• Support rollout of privacy-enhancing technologies and tools
• Identify and escalate potential privacy risks or threats and recommend mitigation strategies
• Lead incident response processes for privacy-related events

• Experience: 2+ years of privacy or related experienc
• Certifications: IAPP certification (CIPP/US, CIPM, or CIPT) strongly preferred
• Strong working knowledge of Canadian (PIPEDA) and U.S. state-level privacy regulations (CCPA, OCPA, Colorado AI Act, Illinois BIPA) and sectoral privacy laws (e.g. CASL, FCRA, HIPAA, CAN-SPAM, COPPA).
• Experience with privacy management platforms (e.g. OneTrust, TrustArc).
• Strong attention to detail, quality and consistency in both written and verbal communications

Education: Bachelor’s degree or master’s in information technology, Computer Science, Cybersecurity or related experience required.