Senior GRC Analyst, Privacy

Benevity is hiring a remote Senior GRC Analyst, Privacy to lead and elevate our data protection program across an intricate, multi-jurisdictional regulatory environment. Based out of Calgary, Alberta, this full-time role puts you at the center of how Benevity earns and keeps the trust of clients, employees, and communities.

About the Role

As Senior GRC Analyst, Privacy, you will own the architecture, day-to-day operation, and ongoing maturity of Benevity's privacy compliance program. Your remit covers GDPR, UK-GDPR, CPRA/CCPA, PIPEDA, CASL, and a growing set of global frameworks. Embedded alongside Legal, Security, Engineering, Product, and Data Governance, you will translate dense regulatory requirements into pragmatic, business-ready controls and bake Privacy by Design into how Benevity builds.

Key Responsibilities

• Maintain Records of Processing Activities (ROPA) under both controller and processor regimes, aligned with GDPR Article 30 and equivalent rules.
• Author and refresh privacy policies, notices, standards, and control frameworks spanning GDPR, UK-GDPR, CPRA/CCPA, PIPEDA, CASL, and emerging laws (India DPDP, Swiss FADP, AU Privacy Act).
• Design and run DSAR intake, triage, and response workflows within statutory deadlines (30 days GDPR, 45 days CPRA).
• Operationalize and continuously improve the Data Protection Impact Assessment (DPIA) process and subprocessor governance under GDPR Article 28.
• Support the DPO function, including breach-notification readiness and supervisory-authority engagement in step with Legal.
• Review Data Processing Agreements and transfer mechanisms (SCCs, UK IDTAs), and monitor the global regulatory horizon.
• Enhance privacy workflows in GRC tooling (e.g., OneTrust), deliver executive dashboards, and use AI to scale output without scaling headcount.
• Build privacy awareness and training, and advise teams as a trusted cross-functional partner.

Qualifications

• 5+ years in privacy, data protection, GRC, or a related field, ideally in SaaS or high-growth tech.
• Deep, hands-on command of GDPR, UK-GDPR, CPRA/CCPA, PIPEDA, and CASL, plus familiarity with India DPDP, Swiss FADP, and AU Privacy Act reforms.
• Proven experience building ROPAs, running DSARs, conducting DPIAs, and maintaining subprocessor inventories.
• Background supporting a DPO function and reviewing DPAs and transfer mechanisms with Legal.
• Practical use of privacy/GRC platforms (OneTrust, Hyperproof, or similar) and a track record of applying AI and automation as a force multiplier.
• Clear communicator across technical, legal, and business audiences; CIPP or comparable certification is an asset.

About Benevity

Benevity gives companies and their people the technology to act on the causes they care about — through giving, volunteering, grantmaking, employee resource groups, and micro-actions. Trusted by most of the Fortune 100 and one of Canada's first B Corporations, Benevity employs people across Canada, Spain, Switzerland, the UK, the US, and beyond.

How to Apply

To apply, complete your application directly on this page, or you'll be redirected to the employer's application platform to finish submitting there.