High-Level Overview

Benevity is seeking a Governance, Risk & Compliance (GRC) Analyst to support and grow our security governance, risk, privacy, and regulatory program. In this role, you will contribute to the execution of Benevity’s GRC program by supporting compliance activities, assisting with risk assessments, contributing to third-party risk management, responding to client due diligence requests, and helping maintain the policies and controls that strengthen trust with our clients, partners, and stakeholders.

Working alongside experienced GRC professionals, you will build your skills in information security, compliance, and risk management while helping ensure Benevity aligns with leading standards, privacy laws, and regulatory requirements. This is a hands-on role with significant learning and growth opportunities across governance, risk, audit, and privacy domains.

What you'll do:

Governance & Policy

• Assist in maintaining and rolling out security and privacy policies, standards, and control frameworks aligned to ISO 27001, SOC 2, NIST, PCI DSS, GDPR, PIPEDA, FINTRAC, and other global regulations.
• Support policy exception management, attestation processes, and identify opportunities for process improvement.

Risk Management

• Assist with enterprise risk assessments, including vendor and process-level reviews.
• Support maintenance of the risk register, track remediation activities, and assist with risk treatment planning.
• Contribute to Benevity’s Third-Party Risk Management (TPRM) program, including vendor onboarding assessments, ongoing monitoring, and remediation tracking.

Compliance & Audit

• Support audit readiness and response efforts for ISO 27001, SOC 2, PCI DSS, GDPR, PIPEDA, FINTRAC, and other frameworks.
• Assist with evidence gathering, control validation, and auditor engagement.
• Leverage GRC platforms to support audit, privacy, and compliance workflows.

Client Support & Sales Enablement

• Support the sales process by responding to client inquiries related to security, privacy, and compliance.
• Complete customer security questionnaires, RFPs, and third-party risk management (TPRM) requests.
• Partner with sales and client success teams to provide timely, accurate responses that build client trust.

Privacy and Regulatory

• Support privacy-related initiatives across jurisdictions (GDPR, PIPEDA, CCPA/CPRA, and others).
• Collaborate with legal and data governance teams to help ensure compliance with data protection and financial crime regulations.
• Assist with FINTRAC-related compliance requirements, including reporting and risk assessments related to AML/ATF obligations.
• Monitor regulatory changes (privacy, AML, financial crime) and help align internal processes accordingly.

Advisory & Awareness

• Partner with business and technical teams to support the embedding of risk and compliance into projects and initiatives.
• Assist in delivering reporting and insights (dashboards, risk metrics, summaries) for leadership.
• Contribute to Benevity’s Security Awareness & Training program, including awareness campaigns, training modules, and phishing simulations.
• Contribute to training, documentation, and awareness activities that strengthen Benevity’s security, privacy, and compliance culture.

What you'll bring:

• 2–4 years of experience in cybersecurity, governance, risk, compliance, or privacy, ideally in a SaaS or technology-driven environment. (For a Junior GRC Analyst, we welcome candidates with 0–2 years of experience, including relevant internship, co-op, or academic project experience.)
• Working knowledge of security, privacy, and regulatory frameworks including ISO 27001, NIST, SOC 2, PCI DSS, GDPR, PIPEDA, FINTRAC, and/or CCPA/CPRA.
• Exposure to or experience with GRC tooling (e.g., OneTrust, Hyperproof, SecurityPal, AuditBoard, Drata) to support policy, risk, audit, privacy, and vendor risk workflows.
• Familiarity with risk assessment methodologies, vendor risk concepts, and compliance evidence gathering.
• Experience or willingness to support client due diligence processes (security questionnaires, RFPs, TPRM).
• Ability to communicate risk, security, privacy, and regulatory concepts clearly to both technical and non-technical stakeholders.
• Strong organizational skills, attention to detail, and a proactive approach to learning and problem-solving.
• An interest in leveraging automation and AI to streamline GRC processes and enhance efficiency is a plus.
• Certifications such as Security+, CISM, CISA, CRISC, or CIPM/CIPP are valued; candidates actively pursuing certification are encouraged to apply.

High-Level Overview

Benevity is seeking a Senior Governance, Risk & Compliance (GRC) Analyst to elevate our security governance, risk, privacy, and regulatory posture. In this senior role, you will drive the execution, innovation, and continuous improvement of Benevity’s GRC program. You will lead compliance activities, conduct risk assessments, contribute to third-party risk management, respond to client due diligence requests, support FINTRAC/AML obligations, and influence policies and controls that strengthen trust with our clients, partners, and stakeholders.

As a trusted advisor across teams, you will help ensure Benevity aligns with leading standards, privacy laws, and regulatory requirements while fostering a culture of security, compliance, and accountability. You’ll also mentor junior members of the team, helping to grow Benevity’s next generation of security and compliance professionals, with a focus on developing proactive and innovative approaches to GRC challenges.

What you'll do:

Governance & Policy

• Contribute to the development, maintenance, and rollout of security and privacy policies, standards, and control frameworks aligned to ISO 27001, SOC 2, NIST, PCI DSS, GDPR, PIPEDA, FINTRAC, and other global regulations.
• Support policy approval, exception management, and attestation processes, actively seeking opportunities for process improvement and automation
  
  

Risk Management

• Lead and execute enterprise-wide risk assessments, including vendor and process-level reviews.
• Maintain and improve the risk register, track remediation activities, and support risk treatment planning.
• Contribute to Benevity’s Third-Party Risk Management (TPRM) program, including vendor onboarding assessments, ongoing monitoring, and remediation tracking.
  
  

Compliance & Audit

• Lead audit readiness and response efforts for ISO 27001, SOC 2, PCI DSS, GDPR, PIPEDA, FINTRAC, and other frameworks.
• Coordinate evidence gathering, control validation, and auditor engagement.
• Leverage GRC platforms to streamline audit, privacy, and compliance workflows.

Client Support & Sales Enablement

• Support the sales process by responding to client inquiries related to security, privacy, and compliance.
• Complete customer security questionnaires, RFPs, and third-party risk management (TPRM) requests.
• Partner with sales and client success teams to provide timely, accurate responses that build client trust.
  
  

Privacy and Regulatory

• Support privacy-related initiatives across jurisdictions (GDPR, PIPEDA, CCPA/CPRA, and others).
• Collaborate with legal and data governance teams to ensure compliance with data protection and financial crime regulations.
• Assist with FINTRAC-related compliance requirements, including reporting and risk assessments related to AML/ATF obligations.
• Monitor regulatory changes (privacy, AML, financial crime) and help align internal processes accordingly.

Advisory, Awareness & Mentorship

• Partner with business and technical teams to embed risk and compliance into projects and initiatives.
• Deliver reporting and insights (dashboards, risk metrics, executive summaries) for leadership.
• Lead Benevity’s Security Awareness & Training program, including the design, delivery, and continuous improvement of awareness campaigns, training modules, and phishing simulations.
• Contribute to training, documentation, and awareness activities that strengthen Benevity’s security, privacy, and compliance culture.
• Mentor and coach junior team members, providing guidance, feedback, and knowledge sharing to support their growth and development.

What you'll bring:

• 5+ years of experience in cybersecurity, governance, risk, compliance, or privacy, ideally in a SaaS or high-growth environment.
• Strong knowledge of security, privacy, and regulatory frameworks including ISO 27001, NIST, SOC 2, PCI DSS, GDPR, PIPEDA, FINTRAC, and CCPA/CPRA.
• Hands-on experience with GRC tooling (e.g., OneTrust, Hyperproof, SecurityPal, AuditBoard, Drata) to manage policies, risks, audits, privacy, and vendor risk workflows.
• Proven success in conducting risk assessments, managing vendor risk/TPRM, maintaining risk registers, and driving remediation.
• Experience supporting client due diligence processes (security questionnaires, RFPs, TPRM).
• Ability to clearly communicate risk, security, privacy, and regulatory concepts to both technical and non-technical stakeholders.
• Strong organizational and project management skills with experience leading cross-functional initiatives.
• A demonstrated interest and track record in leveraging automation and AI to streamline GRC processes and enhance efficiency.
• Certifications such as CISM, CRISC, CISSP, CISA, or CIPM/CIPP are highly valued.

At Lyft, our mission is to build a more connected world, ride by ride. 

Lyft connects people to transportation to change the way we live and get around our communities. Our drivers and passengers entrust Lyft with their personal information and travel details to get where they are going and expect us to keep that data safe. Lyft’s Privacy team is comprised of engineers and analysts dedicated to ensuring that appropriate data protection measures are applied at all times. We conduct privacy risk assessments, consult with organizational stakeholders, maintain Lyft’s privacy program, develop privacy policies, and advise on all matters related to privacy.

We are looking for a highly motivated, organized, and passionate individual to join our Privacy and Compliance Team. As a member of this team, you will engage in our privacy-by-design process to ensure that privacy and security are built into our products by default.  Every day, you’ll partner with stakeholders across the company working on exciting new projects, help de-risk their product development, conduct risk assessments, and serve as a trusted adviser to teams across Lyft. You’ll help our team stay organized, on track, and ensure both us and teams across Lyft are meeting their strategic goals. 

This role is ideal for someone who thrives on building structure and takes pride in keeping complex, fast-moving programs organized. You're someone who loves building/improving systems, documenting processes so others can follow them, and maintaining visibility across many workstreams at once. You get energized by cross-functional collaboration and find satisfaction in being the connective tissue that helps teams stay aligned, accountable, and moving forward.

Responsibilities:

• Drive operational excellence across the privacy team by streamlining workflows, eliminating redundancies, and building scalable processes that improve team efficiency and output quality
• Develop and track meaningful program metrics to establish accountability, measure effectiveness, and communicate program health to leadership and cross-functional stakeholders
• Build and maintain team expertise in tooling and operations software, ensuring consistent adoption and optimal utilization across the program
• Conduct privacy risk assessments of new and existing Lyft products, services, and processes
• Assess third parties for security and data protection controls, and provide risk assessments and mitigation recommendations
• Support and improve the team’s planning and reporting procedures
• Build strong cross-functional relationships with product and engineering teams and advise them on complex data privacy-related issues
• Communicate risk to both technical and non-technical stakeholders across the business and negotiate risk mitigation strategies
• Develop and maintain internal privacy policies, guidelines, and best practices for Lyft

Experience:

• Knowledge of a broad range of privacy concepts and demonstrated ability to apply them to real-world situations
• Experience conducting privacy risk assessments, third party risk assessments, and and risk mitigation
• Experience with privacy regulations (e.g., CCPA, GDPR, PIPEDA)
• Experience with security compliance frameworks (ISO 27001, PCI-DSS, SOC 2) 
• Experience using Jira for project and task tracking, reporting, and program performance monitoring  
• Experience driving operational improvements within a privacy, security, compliance, or risk function, including process design, metrics development, and tooling adoption
• Strong cross-functional communication and leadership skills, with the ability to initiate and drive projects proactively
• Strong teamwork and collaboration skills
• Strong organizational skills and attention to detail 
• Strong written and verbal communication skills
• Ability to own and manage multiple tasks and high priority projects
• IAPP privacy certifications (e.g., CIPP, CIPM, CIPT) a plus

Benefits:

• Extended health and dental coverage options, along with life insurance and disability benefits
• Mental health benefits
• Family building benefits
• Child care and pet benefits
• Access to a Lyft funded Health Care Savings Account
• RRSP plan with company match to help save for your future
• In addition to provincial observed holidays, salaried team members are covered under Lyft's flexible paid time off policy. The policy allows team members to take off as much time as they need (with manager approval). Hourly team members get 15 days paid time off, with an additional day for each year of service 
• Lyft is proud to support new parents with 18 weeks of paid time off, designed as a top-up plan to complement provincial programs. Biological, adoptive, and foster parents are all eligible.
• Subsidized commuter benefits and Lyft ride credits

Lyft is committed to creating an inclusive workforce that fosters belonging. Lyft believes that every person has a right to equal employment opportunities without discrimination because of race, ancestry, place of origin, colour, ethnic origin, citizenship, creed, sex, sexual orientation, gender identity, gender expression, age, marital status, family status, disability, pardoned record of offences, or any other basis protected by applicable law or by Company policy. Lyft also strives for a healthy and safe workplace and strictly prohibits harassment of any kind.  Accommodation for persons with disabilities will be provided upon request in accordance with applicable law during the application and hiring process. Please contact your recruiter if you wish to make such a request.

Lyft highly values having employees working in-office to foster a collaborative work environment and company culture. This role will be in-office on a hybrid schedule — Team Members will be expected to work in the office at least 3 days per week, including on Mondays, Wednesdays, and Thursdays. Lyft considers working in the office at least 3 days per week to be an essential function of this hybrid role. Your recruiter can share more information about the various in-office perks Lyft offers. Additionally, hybrid roles have the flexibility to work from anywhere for up to 4 weeks per year. #Hybrid

The expected base pay range for this position in the Toronto area is CAD $136,000 - CAD $170,000, not inclusive of potential equity offering, bonus or benefits. Salary ranges are dependent on a variety of factors, including qualifications, experience and geographic location. Your recruiter can share more information about the salary range specific to your working location and other factors during the hiring process.

Lyft may use artificial intelligence to screen applicants, however, Lyft employees make the ultimate selection and hiring decisions.

This job fills an existing vacancy.