GRC Analyst

At Reltio®, an SAP Company, we believe data should fuel your success in the enterprise AI era. Our Context Intelligence Platform turns fragmented data into a trusted, connected context so AI agents and systems can act with expert-level judgement at enterprise scale. Reltio’s cloud-native SaaS platform harmonizes, unifies, and governs data across sources and formats - including unstructured data - in real time, turning them into data assets that can be mobilized in milliseconds to any application, user, or AI agent. Trusted by more than 200 of the world’s largest brands across industries such as life sciences, financial services, healthcare, and technology, we fuel frictionless operations and help enterprises accelerate innovation and reduce risk.

At Reltio, our values guide everything we do. With an unyielding commitment to prioritizing our “Customer First”, we strive to ensure their success. We embrace our differences and are “Better Together” as One Reltio. We are always looking to “Simplify and Share” our knowledge when we collaborate to remove obstacles for each other. We hold ourselves accountable for our actions and outcomes and strive for excellence. We “Own It”. Every day, we innovate and evolve, so that today is “Always Better Than Yesterday”. If you share and embody these values, we invite you to join our team at Reltio and contribute to our mission of excellence.

Reltio has earned numerous awards and industry and analyst recognition for our technology, our culture and our people. Reltio was founded on a distributed workforce and offers flexible work arrangements to help our people manage their personal and professional lives. If you’re ready to work on unrivaled technology where your desire to be part of a collaborative team is met with a laser-focused mission to enable digital transformation with connected data, let’s talk!

• Prepare accurate, timely responses to customer security, privacy, compliance, and AI governance questionnaires and inquiries. Coordinate with internal subject matter experts to validate responses and gather supporting documentation.
• Maintain reusable questionnaire responses and customer-facing compliance materials to improve consistency, accuracy, and turnaround time.
• Respond to ad-hoc customer requests for audit reports, certifications, policies, and control evidence. Escalate complex or high-risk inquiries appropriately and track trends to identify gaps in documentation or controls.
• Execute third-party risk assessments across the vendor lifecycle (intake, due diligence, onboarding, periodic review, offboarding). Maintain the vendor inventory and risk tiering.
• Support vendor risk management by conducting security and privacy assessments, reviewing vendor documentation, identifying potential risks, and tracking remediation activities with business owners.
• Maintain vendor assessment records and coordinate initial reviews, periodic reassessments, and follow-up activities in accordance with applicable policies and procedures.
• Support GDPR-related requests by gathering relevant information, maintaining request records, tracking deadlines, and coordinating responses with Legal, Privacy, and other stakeholders.
• Develop and maintain working knowledge of SAP’s internal privacy, vendor management, policy management, and related governance processes. Help the GRC team navigate applicable requirements, identify process owners, and coordinate required submissions and approvals.
• Support additional GRC activities based on team priorities, including audit preparation, evidence collection, policy reviews, risk assessments, compliance training, access reviews, and issue tracking.
• Maintain organized, accurate documentation; communicate progress and blockers; and identify opportunities to simplify and improve GRC processes.
• Communicate clearly and professionally with customers, vendors, and internal stakeholders at all levels, translating technical and regulatory requirements into plain, accurate language.
• Support the team where needed, including but not limited to: risk register maintenance, compliance monitoring, security awareness and training tracking, issue management, and GRC tooling administration.

• Bachelor’s degree in information systems, cybersecurity, business, accounting, or a related field, or equivalent practical experience.
• At least two years of relevant experience in governance, risk, and compliance; information security; privacy; audit; or third-party risk management.
• Experience preparing customer security or compliance questionnaire responses and reviewing vendor security and privacy documentation.
• Working knowledge of common security and compliance frameworks and familiarity with GDPR concepts and privacy request workflows.
• Experience working in or supporting a cloud, enterprise software, or Software-as-a-Service (SaaS) environment, with an understanding of shared security responsibilities.
• Strong written and verbal communication skills, including the ability to translate technical information into clear, accurate responses for customers and internal stakeholders.
• Strong attention to detail, sound judgment, and the ability to manage multiple requests, meet deadlines, and follow through on outstanding items.
• Ability to collaborate across Security, Legal, Privacy, Product, Engineering, Sales, Procurement, and other business functions.
• Proficiency with documentation tools, and ticketing or workflow systems, along with the ability to learn new tools and internal processes.

• Prior experience within SAP or familiarity with SAP’s internal privacy, vendor management, policy management, and compliance processes.
• Familiarity with Master Data Management (MDM) platforms and the security and privacy considerations associated with managing enterprise data.
• Experience with trust centers, questionnaire management tools, Jira, ServiceNow, or Confluence.
• Experience supporting audits or assessments involving SOC 1, SOC 2, ISO 27001, HITRUST CSF, or privacy frameworks.
• Familiarity with AI governance, AI risk assessments, or customer AI questionnaires.
• Relevant certifications, such as CISA, CRISC, Security+, CIPP, CIPM, or equivalent credentials.