This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Senior Security Risk Management Analyst based in Canada.
As a Senior Security Risk Management Analyst, you will play a key role in strengthening and scaling an enterprise-wide cybersecurity risk management program. You will lead end-to-end security risk assessments, transform complex risk data into actionable insights, and help establish consistent processes that support effective risk identification and mitigation. Working closely with security specialists, engineering teams, and senior leadership, you will ensure that risks are accurately documented, monitored, and addressed. You will also contribute to the development of risk reporting frameworks, Key Risk Indicators (KRIs), and operational procedures that improve visibility and decision-making. This role offers the opportunity to drive process improvements, introduce automation, and support security governance within a complex technology environment. It is an ideal opportunity for an analytical and proactive professional who thrives in a remote, fast-paced, and evolving organization.
- Conduct end-to-end information security risk assessments, including scoping, data collection, analysis, documentation of findings, and communication of results to relevant stakeholders.
- Apply established risk management methodologies to identify, evaluate, prioritize, and document cybersecurity risks across the organization.
- Support the continuous development and refinement of risk assessment templates, workflows, methodologies, and process documentation to ensure consistency and scalability.
- Maintain accurate risk registers, ensuring that identified risks are properly tracked and progress through mitigation, remediation, or formal risk acceptance processes.
- Develop and maintain Key Risk Indicator (KRI) tracking mechanisms and risk reporting deliverables, translating complex data into clear and actionable insights for senior leadership.
- Collaborate with technical security teams, including Vulnerability Management, Application Security, and Blue Team, to gather relevant information and incorporate operational findings into risk assessments.
- Identify opportunities to streamline, standardize, and automate risk management processes, presenting improvement recommendations to program leadership.
- Contribute to the development, documentation, and maintenance of security risk management standards, policies, procedures, and operational guidance.
- Work closely with cross-functional stakeholders, including Compliance, Internal Audit, Engineering, and Legal, to contextualize risk findings and ensure appropriate follow-up actions.
- Support audit readiness activities, internal reviews, and risk-related reporting requirements in coordination with program leadership.
- Continuously evaluate existing processes and recommend practical improvements that enhance the effectiveness, efficiency, and maturity of the security risk management program.
Requirements:
- At least 5 years of professional experience in information security risk management, cybersecurity governance, or Governance, Risk, and Compliance (GRC).
- Demonstrated hands-on experience conducting and managing security risk assessments independently, including documenting findings and following up on remediation activities.
- Strong working knowledge of established risk management frameworks and methodologies, such as NIST Cybersecurity Framework (NIST CSF), ISO 27005, PCI DSS, or DoCRA.
- Proven ability to develop structured, repeatable, and scalable processes from previously informal or ad hoc operational practices.
- Strong analytical and data management skills, with the ability to collect, clean, interpret, and present complex risk information accurately.
- Experience contributing to Key Risk Indicator (KRI) monitoring, risk dashboards, and reporting deliverables for internal stakeholders and senior management.
- Familiarity with Governance, Risk, and Compliance platforms such as AuditBoard, Archer, OneTrust, or ServiceNow GRC.
- Proficiency in Google Workspace, particularly for documentation, reporting, and collaboration. Knowledge of SQL and/or Tableau is a strong advantage.
- Excellent written communication skills, with the ability to produce clear, structured, accurate, and professional reports and documentation.
- Strong organizational and problem-solving abilities, with a detail-oriented approach to risk analysis and process management.
- Ability to work independently, take ownership of responsibilities, and navigate ambiguous situations while remaining aligned with strategic direction.
- Bachelor's degree or higher in Information Technology, Cybersecurity, Business Administration, Engineering, or a related discipline.
- Professional certifications such as CISM, CRISC, or ISO 27001 are considered an advantage.
- Previous experience within fintech, financial services, or other regulated industries is preferred.
- Strong interpersonal and stakeholder management skills, with the ability to collaborate effectively across technical and non-technical teams.
Benefits:
- Fully remote working arrangement, with the flexibility to work from Canada.
- Opportunity to contribute to the development and maturity of an enterprise-scale cybersecurity risk management program.
- Exposure to complex security challenges within a global financial technology environment.
- Opportunity to collaborate with experienced professionals across Security, Engineering, Compliance, Internal Audit, and Legal teams.
- Meaningful ownership of risk management initiatives, with the ability to influence processes, frameworks, and operational improvements.
- Opportunity to work with established cybersecurity and risk management frameworks, tools, and technologies.
- Professional development through exposure to evolving cybersecurity practices, governance standards, and enterprise risk management strategies.
- Inclusive and international working environment that values diverse backgrounds, expertise, and perspectives.
- Merit-based recruitment approach focused on professional capabilities, relevant experience, and skills.
