Cybersecurity Governance & Policy Specialist

Raise - find a more meaningful working experience; Vancouver; On-site; CAD 75,000 - 107,000; Full time

Job summary

Raise is recruiting on behalf of a major Canadian energy supplier for a Cybersecurity Governance & Policy Specialist in Vancouver. The role focuses on translating regulatory obligations and business needs into clear policy language while aligning with risk, governance, and compliance needs.

Reporting to the Lead, you will develop and maintain policies, perform gap analyses, and support project teams with security governance across frameworks like NIST, RMF, and ISO 27001/2.

Qualifications

• Five+ years IT experience with at least three years in cybersecurity or policy.
• Deep knowledge of NIST CSF, NIST SP 800-53r5, RMF, AI RMF, COBIT, ISO 27001/2, BC FIPPA.
• Ability to author, review, and refine enterprise cybersecurity policies and guidelines.
• Hands-on exposure to cloud security controls and AI risk management frameworks.
• Must be able to obtain security clearance for a Security Sensitive Position.
• Strong written and verbal communication with both technical and executive stakeholders.

Responsibilities

• Policy & Standards Development: draft, review, and update cybersecurity policies, standards, and guidelines.
• Gap Analysis & Optimization: identify gaps and overlaps, recommend improvements.
• Risk Translation: convert complex risks into clear policy language for business.
• Governance, Risk & Compliance Support: provide guidance and impact assessments to projects and teams.
• Regulatory Alignment: support compliance with NIST, RMF, AI RMF, COBIT, ISO 27001/2, BC FIPPA, NERC CIP.
• Cloud & Emerging Tech Security: evaluate security controls for cloud and AI risk.
• Vulnerability & Risk Monitoring: review assessments and monitor threats.
• Remediation & Controls Validation: verify baseline configurations and test results.
• Incident Response Collaboration: draft reports and support incident response teams.
• Operational Transition: define security requirements for transitions from project to operations.

Skills

NIST CSF

NIST SP 800-53r5

RMF

AI RMF

COBIT

ISO 27001/2

BC FIPPA

Policy writing

Cloud security

Threat analytics

Education

Bachelor’s Degree in CS/InfoSec

CISSP/CISM/CISA/CCSP/CRISC

Tools

SIEM

Vulnerability scanning

Threat analytics

AD/Directory Services

Job description

Cybersecurity Governance & Policy Specialist

• Pay Rate: $66.37/hour, depending on experience
• Contract: Start Date2026-11-16End Date2027-11-16(1 year)
• Location: Vancouver, British Columbia

Raise is currently hiring a Cybersecurity Governance & Policy Specialist on behalf of our client. They’re expanding their team to meet growing needs, making this a unique opportunity to work with an industry leader. Our Client, is one of the largest electrical energy suppliers in Canada.

Note: The primary pay rate is based on T4 classification; however, we will also consider applications from candidates interested in an INC classification, where applicable.

Description

Reporting directly to the Cybersecurity Governance & Performance Lead, the Cybersecurity Governance & Policy Specialist works closely and collaboratively with cross-functional stakeholders to review, draft, and maintain cybersecurity policies, standards, and guidelines. This role plays a critical part in translating complex technical risks, emerging technologies (such as Cloud and AI), and regulatory obligations into clear, actionable policy language. The ideal candidate will bridge cybersecurity operations, governance, risk, and compliance (GRC) to protect critical information infrastructure and ensure compliance with digital technology regulations and industry frameworks.

Responsibilities

• Policy & Standards Development
• Develop & Maintain Policies: Draft, review, tune, and update ’s cybersecurity policies, standards, and guidelines in alignment with business goals, regulatory obligations, and industry standards.
• Gap Analysis & Optimization: Identify control gaps, outdated specifications, or overlapping requirements; recommend clear, actionable policy improvements.
• Risk Translation: Translate complex cybersecurity risks, regulatory mandates, and technical specs into clear, concise, and structured policy language for business stakeholders.
• Governance, Risk & Compliance Support
• Project Guidance: Provide cybersecurity governance, policy guidance, and compliance impact assessments to project managers, technology teams, and business units.
• Regulatory Alignment: Support compliance initiatives across key frameworks including NIST CSF / 800-53r5, RMF, AI RMF, COBIT, ISO 27001/2, BC FIPPA, and NERC CIP.
• Cloud & Emerging Tech Security: Evaluate security controls and governance models for cloud environments and artificial intelligence (AI) risk frameworks.
• Risk Reduction & Incident Support
• Vulnerability & Risk Monitoring: Identify potential cybersecurity risks and incidents by reviewing vulnerability assessments, monitoring external threats, and analyzing log data.
• Remediation & Controls Validation: Analyze security test results, confirm risk impacts, and validate baseline security configurations for operating systems, networks, applications, and telecommunications equipment.
• Incident Response Collaboration: Support security operations during and after critical system incidents/breaches by drafting incident reports and collaborating with incident response leads to ensure policy adherence.
• Operational Transition: Assist business groups in defining security requirements, design, and testing, ensuring seamless transitions of new security systems from project phase to operations.

Qualifications

• Minimum of five (5) years of IT experience, with at least three (3) years dedicated to cybersecurity or a related GRC/policy field.
• Deep understanding of NIST CSF, NIST SP 800-53r5, Risk Management Framework (RMF), AI RMF, COBIT, ISO 27001/2, and BC FIPPA.
• Demonstrated ability to author, review, and refine enterprise-grade cybersecurity policies, standards, and technical guidelines.
• Hands‑on exposure to cloud security controls and AI risk management frameworks.
• Ability to successfully obtain security clearance for a Security Sensitive Position classification
• Exceptional written and verbal communication skills, capable of engaging technical leads and business executives alike.
• Nice-to-Have Qualifications
• 7+ years of total IT experience with 5+ years in cybersecurity, including 2+ years specifically focused on policy writing and review.
• Industrial & Utility Context: Direct experience with Operational Technology (OT) environments or NERC CIP compliance in a utility or critical infrastructure setting.
• GRC & SecOps Integration: Background bridging cybersecurity operations (SIEM, vulnerability management, threat analytics) with enterprise GRC.
• Technical Environment & Tooling Knowledge
• Active Directory, Network Architecture, Vulnerability Scanning, Penetration Testing, Log Management, Auditing, Configuration Management, Asset Management, Continuous Monitoring, Encryption, Strong Authentication.
• NGFW, WAF, SIEM, Intrusion Prevention/Detection (NIPS/HIPS/WIDS), Data Loss Prevention (DLP), Identity & Access Management (IAM), Public Key Infrastructure (PKI), Database Activity Monitoring (DAM).
• Education and Certifications
• Bachelor’s Degree or Technical Diploma in Computer Science, Information Security, or an equivalent field.
• Preferred Certifications: Professional security designation such as CISSP, CISM, CISA, CCSP, CRISC, GCIH, or GPEN.

Additional Information

• Every contractor must supply their own Windows 11 Laptop computer for the duration of the assignment.
• Every contractor must supply their own "Smart Phone".This is needed to gain access to the Organizations network.

We have a dedicated webpage for accommodations where you can learn more about what we offer and request accommodation: https://raise.jobs/accommodations/

In order to submit candidates for roles, our clients will sometimes require personal information to confirm the identity of applicants and their legal status to work. Raise will never ask you for personal or banking information unless you have been selected for a job. If you are ever unsure about the legitimacy of this or any other Raise job posting (or have any other questions), please contact us at [phone] or [e-mail].

We strive to build teams that reflect the diversity of the communities we work in. We encourage all qualified applicants to apply, including people from traditionally underrepresented groups such as women, visible minorities, Indigenous peoples, people identifying as LGBTQ2SI, veterans, and people with visible/nonvisible disabilities.