Information Security Compliance Analyst (12 Month Contract)

• Assist in refining and delivering D2L's Security program and ensuring alignment of these to D2L's compliance program.
• Promote a culture of security awareness through training and knowledge campaigns across the organization.
• Improve D2L's posture and transparency on security, privacy and compliance practices, both internally and externally
• Perform security risk assessments pertaining to governance, people, data, software, hardware, and cloud infrastructure.
• Perform alignment of risk mitigation strategies/plans to industry standards - ISO 27001/NIST SP 800-53R4/ PCI DSS etc.
• Perform third party/vendor/partner security risk assessments.
• Facilitate and manage external audits and conduct internal audits.
• Provide security representation and responses for new deals and proposals.
• Monitor and enforce data privacy policies in partnership with the D2L Legal team.

• In-depth knowledge of information security principles, practices, and technologies, including risk assessment, security controls, encryption, access controls, and incident response.
• Understanding of relevant data protection and security regulations (e.g., GDPR, HIPAA, PCI DSS) and the ability to ensure the organization's adherence to these requirements.
• Familiarity with various compliance frameworks, such as ISO 27001, NIST Cybersecurity Framework, and CIS Controls, and the ability to apply them to assess and improve security controls in a DevOps environment.
• Proficiency in conducting security audits, Cloud Security risk assessments, and compliance evaluations to identify vulnerabilities and ensure compliance with policies and regulations.
• Capability to develop and update security policies, standards, and procedures to align with industry best practices and regulatory requirements.
• Competence in identifying, assessing, and prioritizing Cloud/Application/Infrastructure security risks and implementing risk management strategies.
• The capability to evaluate complex security challenges, think critically, and make informed decisions.

• A strong understanding of information security principles, best practices, standards (e.g., ISO 27001, NIST Cybersecurity Framework), and relevant regulations (e.g., GDPR, HIPAA).
• Familiarity with compliance frameworks and risk assessment methodologies to identify, assess, and mitigate security risks within the organization.
• Ability to conduct security assessments and audits to ensure compliance with internal policies and external regulations.
• Strong analytical skills to evaluate security incidents, identify patterns, and recommend improvements to security controls and processes.
• Knowledge of IT systems, networks, and infrastructure to understand potential security vulnerabilities and effectively assess security controls.
• Understanding of data privacy regulations and best practices to protect sensitive information and ensure compliance with data protection laws.
• Capability to develop and update security policies, standards, and procedures to align with industry best practices and regulatory requirements.
• Knowledge of vulnerability assessment tools and practices to identify and address potential security weaknesses.
• Ability to design and deliver security awareness and training programs for employees to promote a security-conscious culture.
• Effective written and verbal communication skills to articulate security risks, compliance issues, and remediation plans to both technical and non-technical stakeholders.
• Skills to manage security compliance projects, coordinate with teams, and ensure timely completion of tasks.
• Collaboration and teamwork are crucial for working with various departments and stakeholders to achieve compliance objectives.

• A bachelor's degree in Computer Science, Information Technology, Cybersecurity, or a related field is usually preferred
• Minimum 4 years experience in the Information Security field required
• Certifications: Preferred certifications for this role may include:
• Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), CompTIA Security+, Certified Ethical Hacker (CEH), GIAC Security Essentials (GSEC)
• Knowledge of Security Frameworks and Standards: Familiarity with information security frameworks and standards such as ISO 27001, ISO 27701, NIST 800-53R4, StateRAMP/FedRAMP, CSAE 3416/SSAE18; SOC1/2/3, NIST Cybersecurity Framework, GDPR, or PCI DSS is essential for ensuring compliance with relevant regulations and best practices.
• Experience using enterprise-grade governance risk and compliance (GRC) tools.
• You have experience performing audits, particularly in a public cloud & DevOps environment.
• You enjoy getting to the root of a problem and exploring all possible solutions
• You have experience building, managing and securing the large enterprise, web scale and serverless environments.
• You have a passion for exploring modern technologies and patterns to maintain our customer's privacy and confidentiality and protect D2L's intellectual property.

D2L