Senior GRC Analyst

Benevity is hiring a Senior GRC Analyst in Canada to strengthen how we govern security, risk, privacy, and regulatory compliance across a fast-moving SaaS environment. This full-time role puts you at the center of building trust with the clients, partners, and stakeholders who rely on Benevity every day.

About the Role

As Benevity's Senior Governance, Risk & Compliance (GRC) Analyst, you will own the day-to-day execution and ongoing maturation of our GRC program. You'll lead compliance and audit activities, run risk assessments, support third-party risk management, answer client due diligence requests, and help meet FINTRAC/AML obligations. Acting as a cross-team advisor, you'll shape policies and controls, keep Benevity aligned with leading frameworks and privacy laws, and champion a culture rooted in security and accountability.

Key Responsibilities

• Help build and maintain security and privacy policies and control frameworks mapped to ISO 27001, SOC 2, NIST, PCI DSS, GDPR, PIPEDA, FINTRAC, and other global regulations.
• Manage policy approvals, exceptions, and attestations while pursuing automation and process improvements.
• Plan and carry out enterprise risk assessments, maintain the risk register, and drive remediation and treatment planning.
• Advance the Third-Party Risk Management (TPRM) program through vendor onboarding reviews and ongoing monitoring.
• Lead audit readiness for ISO 27001, SOC 2, PCI DSS, GDPR, PIPEDA, FINTRAC, and beyond, coordinating evidence and auditor engagement.
• Respond to customer security questionnaires, RFPs, and TPRM requests in partnership with sales and client success teams.
• Support cross-jurisdictional privacy work (GDPR, PIPEDA, CCPA/CPRA) and FINTRAC AML/ATF reporting, monitoring regulatory change.
• Deliver dashboards and executive reporting, run the Security Awareness & Training program, and mentor junior team members.

Qualifications

• 5+ years across cybersecurity, governance, risk, compliance, or privacy, ideally in SaaS or high-growth settings.
• Solid command of ISO 27001, NIST, SOC 2, PCI DSS, GDPR, PIPEDA, FINTRAC, and CCPA/CPRA.
• Hands-on use of GRC tooling such as OneTrust, Hyperproof, SecurityPal, AuditBoard, or Drata.
• A track record running risk assessments, TPRM, risk registers, and client due diligence (questionnaires, RFPs).
• Clear communication with technical and non-technical audiences, plus strong project management skills.
• Interest in applying automation and AI to GRC; CISM, CRISC, CISSP, CISA, or CIPM/CIPP certifications are a plus.

About Benevity

Benevity gives companies and their people technology to take meaningful social action through giving, volunteering, grantmaking, employee resource groups, and micro-actions. As one of Canada's first B Corporations, we serve most of the Fortune 100 and work across Canada, Spain, Switzerland, the UK, the US, and more.

How to Apply

To apply, complete your application directly on this page, or you'll be redirected to the employer's application platform to finish submitting there.