Security Risk Management Specialist

This is a fully remote position, open to applicants in Canada.

📋 Description

• Facilitate the complete IT and security risk management lifecycle, encompassing risk identification, assessment, treatment tracking, and reporting.

• Sustain and enhance the enterprise IT/security risk register, ensuring that risks are accurately recorded, evaluated, and assigned to the correct owners.

• Conduct risk assessments across various technology domains (cloud infrastructure, access management, application security) and third-party assessments utilizing the suitable methodology for each case.

• Collaborate with control owners and business stakeholders to assess the effectiveness of risk mitigation controls and pinpoint any gaps.

• Incorporate vendor and technology risk findings into the risk register to streamline tracking and remediation efforts across both IT/Security and Third-Party Risk Management.

• Aid in the creation and upkeep of risk policies, standards, and procedures.

• Assist in the preparation of risk reports and dashboards for senior leadership and committee-level audiences.

• Monitor the threat and vulnerability landscape, aiding in the translation of emerging risks into actionable insights for the organization.

• Support security and compliance initiatives, including PCI DSS, SOC 2, and NIST, from a risk perspective, ensuring that risk findings are integrated into broader compliance efforts.

• Engage in risk-related work streams associated with new product launches, infrastructure modifications, and strategic initiatives.

⛳️ Requirements

• 3–5 years of experience in IT risk management, information security, or a related GRC function, preferably in the financial services or fintech sectors.

• Comprehensive understanding of IT and security risk frameworks such as NIST CSF, ISO 27001, or FAIR.

• Familiarity with essential technology risk domains, including cloud (preferably AWS), identity and access management, and vulnerability management.

• Experience in conducting third-party and vendor assessments, with knowledge of due diligence review methodology being an advantage.

• Proven experience in maintaining risk registers and supporting risk assessment processes.

• Working knowledge of compliance frameworks including SOC 2, PCI DSS, and/or NIST is a significant asset.

• Excellent analytical and written communication skills, capable of translating technical risk findings into clear business language.

• Comfortable collaborating cross-functionally with both technical and non-technical stakeholders.

• Experience with GRC tools and risk management platforms (e.g., Jira, Drata) is beneficial.

• Self-motivated individual capable of operating independently, managing competing priorities, and driving tasks to completion.

• Relevant certifications are advantageous (CRISC, CISA, CISSP, or equivalent).

🏝️ Benefits

• Comprehensive health benefits and life insurance coverage.

• Long-term group savings plan with employer match, facilitated through Wealthsimple for Business.

• 20 vacation days, 4 wellness days, and unlimited sick and mental health days annually.

• Opportunity to work outside Canada for up to 90 days each year.

• Access to employee resource groups, including Rainbow (2SLGBTQ), Women of WS, and Black at WS.