
Governance, Risk and Compliance Specialist
- Coquitlam, BC
- 75.000-85.000 $ par an
- Permanent
- Temps-plein
- Support and assist the GRC Manager in conducting external audits, including but not limited to SOC 2 Type 2 and ISO27001 assurance engagements.
- Responsible for the examination and analysis of internal controls and business risks by performing IT audit work, developing audit scope, performing audit procedures, assessing potential gaps, designing remediation plans, and preparing audit reports.
- Conduct period threat and risk assessment, security and privacy reviews and ad hoc compliance-specific reviews.
- Plan, monitor and conduct testing of the current controls stack
- Report on the results of these assessments, assist in designing the remediation plans for potential gaps.
- Identify additional opportunities for businesses to enhance their information security and privacy posture.
- Deliver security risk management engagements supported by leading practices like ISO 27001, SOC 2, NIST 800-53, CCPA for data privacy, and relevant risk management frameworks.
- Support management in engagement planning and management processes.
- Create, implement, and maintain the information security policies and procedures. Ensure alignment with organizational goals and industry best practices such as ISO27001.
- Collaborate with stakeholders to ensure policies are effectively updated, communicated and adhered to across the organization.
- Assist in preparing reports for senior management and department heads.
- Work with various teams and management from HR, IT, Legal and Engineering departments to align security initiatives with business objectives.
- 4-5 years of relevant experience in IT auditing, including general IT controls, IT application controls testing, IT internal audit, and data analytics.
- Experience with SOC 2 & ISO 27001 or relevant frameworks is a MUST. Exposure with GovRAMP, TxRAMP or CJIS is good to have.
- Exposure to privacy compliance as per CCPA is good to have.
- Experience with GRC tools such as AuditSource or Drata is good to have.
- Deep understanding of information security principles and best practices.
- Knowledge of relevant regulations and compliance frameworks.
- Certifications (e.g., CISA, CISM, CISSP) are good to have.
- Bachelor’s degree in a related field of Information technology/Auditing or demonstrated experience in this field.