Cybersecurity Risk Analyst

• Maintain and improve an IT/Security Risk Assessment Framework
• Document IT security risk, mitigating controls and present them to risk owner for decision taking.
• Coordinate with IT compliance team to ensure compensating controls have been put in place.
• Maintain the IT risk register through out IT risks lifecycle.
• Perform Privacy Impact Assessments (PIA).

• Maintain and improve 3rd party vendors assessment methodology.
• Perform 3^rd party and cloud vendor security posture assessment, document the assessment and present the results to business owners.
• Review 3^rd party contracts for IT security and data privacy related clauses and work in collaboration with IT Procurement and Legal teams.
• Maintain the Cloud vendor register.
• Provide vendor selection services for cybersecurity aspects to help business units select a vendor as part of RFP process.

• Manage and maintain the IT Exception Handling Process.
• Document IT Exceptions, validate the needs from exception requestors and owner, seek exception approval from Cybersecurity management.
• Document risk assessment as needed.
• Maintain the IT Exceptions register and follow-up on approved exceptions.

• Provide project advisory services to Business and IT projects on IT risk matters to ensure risk management activities during project's lifecycle. Occasionally provide support to project security advisory team to document project security requirements and controls to implement.

• Produce and report IT risk management KPI and KRI on a monthly basis.

• Bachelor degree or 5 years of professional experience in Cybersecurity;
• Minimum of 8 years' experience of security governance, risk and compliance (GRC);
• Holds security related certifications such as CISSP, CISM, CSSP or similar an considered an asset;

• Practical experience with implementing and/or working with IT Risk management frameworks;
• Practical experience with performing IT Risk assessment during projects and as part of security operations;
• Practical experience with security controls and risk mitigation measures implementation.
• Practical experience by assessing 3^rd party vendor risks and reviewing security and IT controls related assurances documentation provided by 3^rd parties (e.g., ISO 27001 certifications, SSAE-16/18, SOC1, SOC2, etc...);
• Practical experience with managing an IT exception handling process;
• Hands-on experience and good knowledge in topics such as: identity and access management, network security, Cloud security, cryptography, web security, next generation security solutions and operating system security; and
• Experience with project life cycles, particularly security risk analysis, solutions design and broad systems integration.

• Great organizational and analytical skills;
• Able to vulgarize, ease in expressing ideas, influence others, challenge ideas and be convincing;
• Excellent interpersonal skills to be able to interact at all levels;
• Ability to influence and engage with senior management;
• Ability to quickly adapt to changing priorities and demands;
• Worked in a decentralized environment (both technical and processes);
• Experience in an information security (application and/or infrastructure) role in an enterprise environment;
• Structured and autonomous person;
• You have the ability to work well on a collaborative team and influence others without direct authority;
• Excellent written (documentation) and verbal communication skills (English & French) a strong asset

• Alternative Work Arrangements; hybrid remote work and flextime and summer hours
• A modern and spacious work environment
• A flexible insurance plan (life, medical, dental)
• An employee assistance program
• Competitive compensation, including annual bonus plan
• A pension plan with matching company contributions
• Employer-paid development and continuing education

#LI-Hybrid