IT Governance, Risk and Compliance Analyst

This is a fully remote position, open to applicants in United States.

📋 Description

• Oversee governance policies, standards, and procedures related to technology, privacy, and information management.

• Assist with both internal and external audits by providing necessary evidence and documentation.

• Analyze contracts and business initiatives to ensure security, privacy, and compliance obligations are met in collaboration with Legal and Procurement.

• Manage compliance initiatives, including the Colorado Privacy Act, GDPR/UK GDPR, and other contractual/regulatory programs.

• Monitor remediation activities and ensure corrective actions are completed.

• Conduct risk assessments for new technologies, vendors, and operational modifications.

• Maintain the IT risk register and ensure mitigation plans are effectively executed.

• Perform security, privacy, and compliance evaluations of third-party vendors and subprocessors.

• Facilitate vendor onboarding processes and ensure contractual compliance.

• Assess new technologies, integrations, and AI solutions with a focus on privacy and governance considerations.

• Aid in the research, testing, and implementation of new AI functionalities.

• Keep data inventories, Records of Processing Activities, classification, retention, and lifecycle documentation up to date.

• Provide guidance to stakeholders on data collection, usage, sharing, retention, and protection.

• Oversee the monthly cybersecurity awareness training program and assist with additional training initiatives.

• Conduct routine audits of user access, permissions, and IT assets.

• Carry out periodic compliance reviews and governance assessments of systems and processes.

• Collaborate with Infrastructure, Security, Legal, People Team, and Procurement to integrate governance requirements early in technology projects.

⛳️ Requirements

• Bachelor's degree in a relevant field, or equivalent experience, in governance, compliance, risk management, privacy, information security, or business operations.

• 3–5 years of progressively responsible experience in governance, compliance, risk management, privacy, procurement, internal audit, information security, or related areas.

• Proven experience supporting compliance audits, vendor risk assessments, or regulatory programs, including contract and vendor documentation reviews.

• Strong analytical, organizational, communication, and cross-functional collaboration abilities.

• Familiarity with GDPR/UK GDPR, international data transfers, or information governance programs (preferred).

• Background in nonprofit, consulting, research, energy, or other mission-driven organizations (preferred).

• One or more certifications: CIPP/US, CIPP/E, CIPM, CIPT, CRISC, CISA (preferred).

• Must have current, independent authorization to work in the U.S. without present or future sponsorship from RMI.

🏝️ Benefits

• Medical, dental, and vision insurance.

• 403b retirement match with immediate vesting.

• Group life, AD&D, and short- and long-term disability coverage.

• Optional voluntary life, AD&D, and accident plans.

• Health savings or flexible spending accounts.

• Support for fertility and hormonal health.

• Mental health and wellness assistance.

• Comprehensive leaves of absence, including generous parental leave.

• Generous paid time off and sick leave policies.

• Paid sabbatical leave.

• Regional holidays with at least one extended break in each location.

• Work from home opportunities and home technology stipends.

• Learning and development opportunities, including LinkedIn Learning and an annual individual professional development budget.

• Potential for bonuses and merit-based increases.

• Discount marketplace for gym memberships, pet insurance, etc.

• Hybrid and remote work options available.

• Team retreats and regional meetups.

• Rewards and recognition programs.

• Annual bonus target of 5%.

• Eligibility for merit-based salary increases.

• Travel expenses covered for occasional in-person meetings.