Business Analyst- Technology Risk and Control

OPTrust; Toronto; Hybrid; CAD 98,000 - 121,000; Full time

Benefits offered by this job

Hybrid work model

Benefits package

Pension plan

Professional development opportunities

Vacation package

Job summary

OPTrust in Toronto, Ontario, is seeking a Business Analyst to join the Technology Risk and Control team within IT Security and Governance. The role focuses on IT audit, change management, access controls, and risk management, providing project leadership and training support.

The analyst will gather evidence for audits, implement ITGC policies, conduct internal audits, and lead routine projects while ensuring compliance with governance standards. Hybrid work arrangements are available.

Qualifications

• 2-4 years experience in IT audit, IT change management, access management, IT and security governance, risk and control.
• Proven experience preparing policies, procedures, process maps and workflows.
• Proven ability to prepare effective training materials, lead training sessions and one-on-one support.
• Strong judgement, analytical and Project Management skills.

Responsibilities

• Gathers evidence from IT operations and business units for audits, documents, analyzes, and performs audit tests; develops remediation action plans.
• Implements and communicates IT General Controls (ITGC) policies, procedures and programs; aligns with actual practices and objectives.
• Audit Planning & Reporting: plans and conducts internal audits of IT systems and processes; prepares working papers and reports.
• Independently manage the change management process, including CAB meetings and RFC reviews; engage stakeholders; identify risks.
• Review user access rights to ensure least privilege; monitor ITGC alignment with regulatory requirements.
• Document business requirements; perform data research and analysis; bridge business and technical teams.
• Lead small/medium projects; develop plans and schedules; ensure alignment with OPTrust methodology.

Job description

Business Analyst - Technology Risk and Control

Department: IT Security and Governance, Information Technology Operations and Security

Type: Full-Time - Permanent

Posting Date: November 5th, 2026

At OPTrust, paying pensions today, preserving pensions for tomorrow is our mission and business.

When you choose OPTrust, you join a team of smart, talented people who fuel our success and have a passion for pensions. Everyone at OPTrust - in Toronto, London and Sydney - makes a meaningful impact. Our culture is driven by team members with different backgrounds and perspectives creating an inclusive and fulfilling place to work for everyone. We work in a fast-paced environment, but we find time to have fun and give back to the community.

What OPTrust offers you

• Unique culture rooted in our core values – collaboration and teamwork, integrity, respect, flexibility, excellence and continuous improvement.
• A purpose-driven environment where we all work towards the common goal of paying pensions today and preserving pensions for tomorrow.
• Comprehensive benefits focused on your health and wellness, including dental, vision and extended health benefits, as well as membership in our world-class defined benefit pension plan.
• A flexible, hybrid work model.
• A dedicated inclusion, diversity and equity strategy with meaningful opportunities to participate, including our employee-led resource groups.
• Extensive professional development opportunities and learning initiatives including access to LinkedIn Learning, guest speakers, tuition reimbursement, professional association memberships, leadership development programs, a mentorship program, monthly professional development time and more.
• A competitive vacation package with additional work-life balance day.

About the role

The successful candidate will be responsible for executing activities in ITOS division, specifically within IT Security and Governance team under Technology Risk and Control department. This will include business process re-engineering and gathering new business requirements, supporting IT audit, risk management, IT general controls, as well as executing user acceptance testing and training. The analyst will also provide project leadership for projects more routine in nature and provide business and technical application support.

What you’ll do

IT Audit and Compliance

• Gathers evidence from IT operations and business units for both internal and external audits, documenting, analyzing, and performing audit tests to assess controls and compliance. Develops remediation action plans based on findings.
• Implements, maintains, and communicates IT General Controls (ITGC) policies, procedures, and programs. Reviews and ensures alignment with actual practices, corporate objectives, and government standards.
• Audit Planning & Reporting: Plans and conducts internal audits of IT systems, applications, and processes. Prepares working papers, audit reports, and recommendations to management, ensuring proper controls and accuracy of system-generated information.

Change Management, Access Management and IT General Controls

• Independently manage the change management process, including organizing CAB meetings, reviewing RFCs, stakeholder engagement, and identifying risks. Develop contingency plans and ensure communication, business processes, and training are aligned with changes.
• Conduct periodic reviews of user access rights to ensure compliance with the principle of least privilege. Implement and monitor IT General Controls (ITGC) to align with organizational objectives and regulatory requirements, providing recommendations for improvements based on audit findings and emerging risks.

Remediation, Process Enhancement, and Documentation

• Effectively document/review and business requirement documents.
• Perform data research and analysis.
• Play a bridging role between business and technical teams.
• Conduct research to determine best practices for work processes and make recommendations to the user group as to how the processes can be improved.
• Organize and lead work process review and redesign meetings to arrive at decisions.
• Conducting research for the development and defining of product specifications.
• Identify deficiencies in the specifications and in existing products that could affect the functionality of the product and introduce potential issues into the work processes.
• Document deficiencies and provide recommendations to address them for review and approval of Management.
• Provide project leadership from concept to implementation for more routine projects by carrying out project control activities, developing plans and schedules, and ensuring the project is executed in accordance with the OPTrust project management methodology.
• Assess and accurately define and address issues and risks; employ effective strategies to proactively mitigate risks and facilitate resolution of problems and issues.
• Develop and maintain deports using various tools such as Power BI/ Excel.
• Manage small/medium-size projects/phases of the projects.
• Coordinate project team for effective implementation.
• Performs other duties as assigned.
• Ensure clear understanding and adherence of all OPTrust’s policies, procedures, guidelines as well as living our values and fostering an inclusive culture.

What you bring

• Post-secondary education in Technology Risk, Audit or a related field.
• 2-4 years experience in IT audit, IT change management, access management, IT and security governance, risk and control is a must.
• Proven experience preparing policies, procedures, process maps and workflows.
• Proven ability to prepare effective training materials, lead training sessions and one-on-one support.
• Strong judgement, analytical and Project Management skills.
• Ability to work with ambiguity, conceptualize and think creatively.
• Exceptional organizational and time-management skills.
• Excellent interpersonal skills; proven track record as an effective team player and contributor, and participation in consultative processes.
• Holds one or combination of designations in relevant audit or industry standard certifications, (e.g. CISA, CRISC, CIA, CISSP etc.).
• Knowledge of pension industry or Big 4 work experience is an asset.

This posting is for an existing vacancy.

The range of expected compensation for this position is $98,398 to $120,869 per year.

Serving a membership as diverse as ours and investing in a global market means cultivating an environment that embraces inclusion, diversity, and equity in everything we do. OPTrust is an organization engaged in building on our unique and diverse strengths. We know a diversity of backgrounds, cultures, gender identities and perspectives are critical to achieving our shared goals.

If you require accommodation at any time during the recruitment process, please send a message to [e-mail], or discuss your needs with the Talent Acquisition Consultant during the telephone screening. We will do our best to work with you and provide appropriate accommodation.

As an organization we’re seeking ways to respond to the Truth and Reconciliation Commission of Canada’s Call to Action 92. We are working with the Canadian Council for Indigenous Business to build bridges with Indigenous communities and partners, and we have created an employee-led Reconciliation Working Group that will work with Indigenous experts to identify a path to reconciliation for our organization.

We thank all interested applicants, however only those under consideration will be contacted.