Description:

Title: Governance & Compliance Analyst II

Location: India, Remote

What Youll Do

The Governance, Risk & Compliance (GRC) Analyst is an individual contributor responsible for supporting Duck Creek Technologies governance, compliance, privacy, and third-party risk initiatives.

This role collaborates with cross-functional teams to implement compliance and governance strategies, assist with policy development and training, and support privacy and third-party risk management activities.

The GRC Analyst helps support coordinating compliance tracking, assisting with audit preparation, facilitating training and awareness programs, and conducting regulatory research.

By providing operational support and insights, this role contributes to the organizations adherence to regulatory requirements, internal policies, and best practices.

Key Responsibilities

- Support the implementation of privacy, governance, and compliance initiatives across the organization.

- Assist in drafting, reviewing, and updating policies and procedures, ensuring alignment with regulatory requirements and internal standards.

- Maintain records of processing activities (ROPA) and assist with privacy assessments, including documenting Data Protection Impact Assessments (DPIAs).

- Monitor and report privacy incidents and compliance issues, assisting with remediation and follow-up activities.

- Conduct research on global privacy and compliance regulations (e.g., GDPR, CCPA, HIPAA) and summarize implications for internal teams.

- Assist with the development and maintenance of the enterprise governance framework.

- Support the management of organizational policies by coordinating updates, ensuring version control, and maintaining the annual review and approval cycle to keep policies current and compliant with internal and regulatory requirements.

- Support audit preparation and documentation, including collecting evidence, coordinating schedules, and assisting with internal and external compliance reviews.

- Track and maintain compliance dashboards, logs, and trackers to monitor adherence to regulatory obligations and internal policies.

- Generate ad hoc reports and documentation for senior GRC staff, auditors, and leadership, summarizing findings and program status.

- Support Third Party Risk Management (TPRM) activities, including vendor onboarding, ongoing monitoring, and risk assessment.

- Review vendor due diligence responses, identify gaps or concerns, and track remediation efforts.

- Collaborate with cross-functional teams including IT, legal, security, and business units to support privacy, governance, and compliance activities.

- Assist in preparing metrics, reports, and presentations on governance, compliance, privacy, and third-party risk for management and leadership review.

- Perform all other duties and activities as required.

- Act in accordance with and as a good steward of Duck Creek Technologies mission, vision, and core values:

Mission: To empower insurers to reimagine the future of insurance

Vision: To transform insurance technology, helping insurers be smarter, faster, and more efficient, and ultimately provide the best protection for people and businesses

Values: We Prioritize Respect, We Listen, We Care, We Add Value, and We Lead

Competencies

Core Employee:

- Communication: Effective communication, both verbal and written; includes ability to express ideas clearly, listen actively, and collaborate with colleagues and clients.

- Collaboration: Work effectively in teams, build positive relationships, and contribute to achieving common goals ; includes the ability to recognize and incorporate a broad range of diverse perspectives

- Problem Solving: Can analyze complex situations, identify problems, ask important questions, and generate creative solutions; involves critical thinking, adaptability, and the ability to make informed decisions .

- Accountability: Willingness to accept responsibility for your actions and work ; ability to set and achieve meaningful outcomes for oneself

- Adaptability: Can adapt to change, embrace new technologies, and learn quickly; embracing a growth mindset, being flexible and open to different approaches is highly valued

- Integrity: Conducts themselves with integrity and professionalism, understands and models our core values, and is obsessed with doing the right thing; incorporates this mindset in how they behave, in the products or services they provide, and how they treat others

- Cultural Agility: Ability to effectively and comfortably adapt to different cultural contexts. It involves the capacity to understand, communicate, and interact with people from diverse cultural backgrounds in a respectful and inclusive manner.

What Youve Done

Specialized Knowledge, Skills, and/or Abilities:

Required

- Bachelors degree in business, finance, information systems, cybersecurity, or a related field

- 1-3 years of applicable experience in privacy, compliance, third party risk management, or any combination of education and experience that would provide an equivalent background.

Preferred

- Experience in technology, SaaS, or software development environment

- Familiarity with regulatory frameworks and standards such as ISO 27001, NIST, GDPR, and SOC

- Experience supporting SOC 1 and SOC 2 readiness and assessment cycles

Knowledge, Skills, Abilities & Behaviors

- Basic understanding of privacy, compliance, and third-party risk management regulations, practices, and frameworks.

- Working knowledge of IT risk management and cybersecurity principles to support privacy and compliance initiatives.

- Familiarity with third-party risk management frameworks and best practices, including vendor assessments and risk mitigation.

- Ability to interpret and apply privacy, security, and compliance requirements to internal processes and vendor relationships.

- Strong organizational skills, with the ability to track assessments, documentation, remediation actions, and compliance metrics.

- High attention to detail and accuracy, ensuring thorough and reliable compliance and audit documentation.

- Strong analytical thinking and problem-solving abilities, with the capacity to synthesize information and provide actionable insights.

- Effective written and verbal communication skills, including reporting, documentation, and presentation development for multiple audiences.

- Collaborative mindset, able to engage cross-functional teams and build strong working relationships.

- Adaptability and flexibility, responding effectively to shifting priorities, emerging regulations, and evolving business needs.

- Ethical judgment and discretion, handling sensitive and confidential information with integrity.

- Proactive approach to identifying risks and contributing to mitigation efforts, supporting program improvements.

- Initiative in supporting GRC program maturity and automation, assisting with process enhancements and system updates