Required Skills & Experience
Bachelor’s degree in Legal Studies, Paralegal Studies, Business Administration, Information Systems, Cybersecurity, Accounting, Finance, Risk Management, or a related discipline, or equivalent professional experience. Paralegal certificate or demonstrated professional legal-document-review experience preferred. Relevant GRC, audit, security, risk, or compliance certifications such as CISA, CRISC, CGRC, CIA, or CISM are preferred. 5+ years of experience in Governance, Risk & Compliance, Internal Audit, IT Risk Management, Technology Compliance, regulatory compliance, legal operations, paralegal work, or a related field. Experience reviewing legal, contractual, regulatory, or compliance documentation and identifying relevant requirements, obligations, risks, or areas requiring escalation. Experience supporting SOX IT General Controls (ITGC) or comparable control programs, including walkthroughs, testing coordination, evidence review, remediation tracking, or auditor engagement. Working knowledge of one or more frameworks or regulatory areas such as SOX 302/404, SOC 1, SOC 2, PCI DSS, NIST, HITRUST, FTC requirements, COSO, or COBIT. Experience partnering with Legal, Compliance, Security, Technology, Internal Audit, external auditors, or business control owners. Ability to interpret complex written requirements and convert those requirements into organized, actionable documentation. Strong analytical, research, written communication, and document-management skills. Strong attention to detail, particularly when reviewing contractual, regulatory, audit, and control documentation. Ability to manage multiple concurrent assignments and deadlines in a complex enterprise environment. Ability to recognize matters requiring Legal, Privacy, Security, or other subject-matter-expert review and escalate appropriately.
Nice to Have Skills & Experience
Prior experience as a paralegal, senior paralegal, compliance analyst, legal operations analyst, regulatory analyst, or GRC analyst. Demonstrated experience reviewing contracts, regulatory documents, legal correspondence, policies, audit requests, or compliance obligations. Experience supporting contract or regulatory obligation management, including identifying requirements related to audit rights, security, privacy, record retention, incident notification, business continuity, or third-party risk. Experience mapping regulatory or contractual obligations to policies, standards, risks, controls, and evidence. Knowledge of SOX ITGC and SOC 1 / SOC 2 control environments. Familiarity with COSO, COBIT, NIST, and related governance and control frameworks. Experience operating within a first or second line of defense GRC function. Experience with enterprise GRC or audit platforms such as ServiceNow GRC/IRM, Archer, AuditBoard, or OneTrust. Experience researching regulatory requirements and supporting the implementation of corresponding policies or controls. Relevant certifications such as CISA, CRISC, CGRC, CIA, CISM, or paralegal certification are preferred.
Job Description
You are a hands-on Governance, Risk, and Compliance (GRC) professional with experience supporting technology risk, regulatory compliance, audit activities, and control programs within complex enterprise environments.
You bring a combination of GRC expertise and legal or paralegal experience, enabling you to review and interpret contracts, regulatory requirements, legal documents, policies, compliance obligations, and audit materials. You can identify relevant requirements, flag potential compliance concerns, and partner with Legal, Privacy, Security, Technology, and business stakeholders when legal interpretation or escalation is required.
You understand risk and control frameworks such as SOX IT General Controls (ITGC), SOC 1, SOC 2, PCI DSS, NIST, and related regulatory requirements. You are comfortable reviewing controls and supporting evidence, documenting findings, tracking remediation activities, and helping teams remain prepared for audits and regulatory reviews.
As a Senior-level individual contributor, you independently manage assigned compliance and risk activities, apply sound judgment to complex documentation, and escalate significant legal, regulatory, control, or risk issues to the appropriate subject matter experts.
You are detail-oriented, organized, and able to translate complex legal, regulatory, technical, and compliance language into clear requirements and actionable guidance.