Director, Enterprise Data Governance & Controls

QuadReal Property Group; Toronto; On-site; CAD 155,000 - 175,000; Full time

Benefits offered by this job

Health & dental benefits

Pension plan

Paid time off

Performance-based incentive plan

Job summary

QuadReal Property Group is seeking a Director, Enterprise Data Governance & Controls to lead two critical disciplines within Risk & Integrated Assurance. You will shape an operating model, drive data governance, and build controls aligned with COSO and DAMA-DMBOK.

The role focuses on delivering a pilot in Real Estate Debt, scaling across operating companies, and partnering with IT and Data Platform teams to embed governance by design and ensure audit readiness.

Qualifications

• Bachelor’s degree in Accounting, Finance, Business, Risk Management, Data Management, or Computer Science
• 8+ years of progressive experience across business controls, risk management, audit, or data governance
• 2+ years of people leadership
• CPA, CIA, CISA, or CDMP asset

Responsibilities

• Run the Business Controls framework across COSO 2013 across five components and 17 principles.
• Coordinate ICFR program end to end: scoping, risk assessment, control design, testing, remediation, and certification.
• Coordinate SOC 1 / ISAE 3402 fieldwork with external auditors (EY) and remediation.
• Extend COSO coverage to operational controls and AI/automation controls.
• Define QuadReal’s enterprise data definitions and ownership model (DAMA-DMBOK).
• Deliver the Purview-based data glossary and metadata management.
• Set data quality thresholds and Trusted Layer certification criteria, with data observability parity to financial controls.
• Align controls as gates across the data lifecycle and build governance through training and playbooks.
• Lead two direct reports (Business Controls Manager and Data Governance Lead) and grow the function.
• Build team capability in data analytics and AI literacy to move from project to run-state.

Skills

Leadership

Stakeholder comms

Risk management

Data governance

Strategic thinking

Education

Bachelor’s degree in Accounting

Master’s degree asset

CPA/CIA/CISA/CDMP asset

Tools

Microsoft Purview

dbt

Airflow

Power BI

Microsoft Fabric

Job description

About QuadReal Property Group

QuadReal Property Group is a global real estate investment, development and operating company headquartered in Vancouver, British Columbia. Its assets under management are $98.5 billion. From its foundation in Canada as a full-service real estate operating company, QuadReal has expanded its capabilities globally for investments in equity and debt in both the public and private markets. QuadReal invests directly through operating platforms in which it holds an ownership interest and via programmatic partnerships.

QuadReal seeks to deliver strong investment returns while creating sustainable environments that bring value to the people and communities it serves. Now and for generations to come.

QuadReal: Excellence lives here.

www.quadreal.com

Role Description:

The Director, Enterprise Data Governance & Controls is accountable for two disciplines within QuadReal’s Risk & Integrated Assurance function: Business Controls and Enterprise Data Governance. The role reports to the VP, Risk & Integrated Assurance and turns the VP’s enterprise-wide mandate into one accountable operating model.

The Director holds two mandates that work together as one. The first is running and maturing the Business Controls framework, anchored in COSO 2013, and extending it beyond ICFR into data controls, operational controls, and controls for AI and automation. The second is defining and governing the enterprise data those controls rely on, anchored in DAMA-DMBOK, covering data definitions, ownership, quality, and observability. Together they make QuadReal’s controls provable rather than assumed, and its data reliable enough to control.

This is a build-phase role, not a steady-state one. It is measured by what ships and holds up under audit, not by frameworks authored, and by the difference between evidencing a control (retained, re-testable proof that it operated) and merely demonstrating that a job ran. The operating principle is simple: govern only what you deliver, and deliver only what you can stand behind.

The first priority is proving the combined operating model through a focused pilot within the Real Estate Debt Program. Priorities that follow include scaling to more operating companies, AI governance, and expanded data coverage. The Director also supports the VP’s overall view of QuadReal’s risk and control environment and represents Business Controls and Data Governance in Risk & Integrated Assurance reporting.

Responsibilities:

1. Business Controls

• Run QuadReal’s Business Controls framework day to day, anchored in COSO 2013 across all five components and 17 principles.
• Support the ICFR program end to end: annual scoping, risk assessment, control design, testing, remediation, and certification.
• Coordinate SOC 1 / ISAE 3402 fieldwork and evidence collection, work directly with external auditors (EY), and drive remediation before reporting to the VP and BCI.
• Extend COSO coverage beyond ICFR into operational controls, and set controls standards for AI and automation, at a pace the business can absorb.
• Build out the Controls Oversight Framework across data integrity controls, and IT general controls (ITGCs) and own error reporting, escalation, and remediation so leadership always has clear visibility.

2. Enterprise Data Governance

• Define QuadReal’s enterprise data definitions, classifications, and Critical Data Elements (CDEs), anchored in DAMA-DMBOK.
• Own the data ownership and accountability model: name Data Owners, Stewards, and Custodians, and hold them accountable through a defined sign-off cadence.
• Deliver the enterprise business glossary in Microsoft Purview under a tiered governance model, and maintain metadata management, lineage standards, and dbt metadata synchronization across the platform.
• Set data quality thresholds and Trusted Layer certification criteria, and hold data observability (freshness, pipeline health, trust scores) to the same standard as financial controls.
• Align controls as gates across the data delivery lifecycle (ingestion, definition, build, use, and govern), so a control fires wherever data advances and nothing reaches a certified output without passing.
• Build data governance capability across the business through training and playbooks, rather than keeping expertise centralized.

3. Integration and Decision Authority

• Act as the link between Business Controls and Data Governance called for in the integrated operating model: define control standards and evidence expectations alongside data definitions, and build controls into new systems and initiatives from the start.
• Make the final call when control standards and data definitions conflict, including which system is the authoritative source when two systems disagree.
• Work with ED&A / Technology and the Data Platform team so controls and governance are built into the toolchain (Microsoft Fabric, dbt, Airflow, Power BI, Purview, Entra ID, Quadrant) by design, not added after go-live.
• Manage vendors on a fixed-price, deliverable-based footing, keeping design authority and SOC accountability inside QuadReal.
• Represent Data Governance in Risk & Integrated Assurance meetings and Audit Committee reporting, while keeping Internal Audit fully independent.

4. Team Leadership

• Lead and develop two direct reports: the Manager, Business Controls (control register, testing and evidence, ITGC coordination, SOC 1 support) and the Data Governance Lead (glossary, data standards, steward coordination, and the Purview build). Set clear deliverables and cadence for each, and clear their blockers.
• Build team capability in data analytics, AI literacy, and integrated systems controls as the role grows, and build enough bench strength to move the environment from project to sustained run-state without single points of failure.
• Build a "one team" culture between Business Controls and Data Governance that removes duplicate work and closes the gaps that used to sit between the two groups.

What Success Looks Like:

• Controls operating as gates, each with a named owner and re-performable evidence.
• Audit outcomes: clean walkthroughs, deficiencies remediated, and SOC scope defensible.
• Glossary and standards adopted, so certified numbers are built on agreed definitions.
• Governance measured by delivery: trusted, in-use data products standing behind reported figures.
• Both direct reports delivering to plan, with growing capability and bench strength.

Experience and Qualifications:

• Bachelor’s degree in Accounting, Finance, Business, Risk Management, Data Management, Computer Science, or a related discipline; Master’s an asset.
• 8+ years of progressive experience across business controls, risk management, audit, or data governance, including at least 2 years leading people, and demonstrable end-to-end delivery of a control or governance environment.
• Working knowledge of ICFR, SOC 1 / ISAE 3402, COSO 2013, ITGCs, and DAMA-DMBOK; CPA, CIA, CISA, or CDMP an asset. Familiarity with DCAM / CDMC and data contracts an asset.
• Hands-on experience with data cataloguing and governance tooling (Microsoft Purview; equivalents such as Collibra an asset) and with controls testing in an ICFR or SOX environment.
• Working knowledge of a modern data-platform stack (Microsoft Fabric / lakehouse, dbt, Airflow, Power BI, Entra ID), enough to specify and validate controls, not just describe them.
• Ability to work across Finance, IT, and Data & Analytics, and turn technical and operational complexity into clear governance and control frameworks.
• Comfortable preparing materials for senior leadership and the Audit Committee and presenting to them directly.
• Comfortable building or growing an early-stage function, not just running a mature one.
• Experience within real estate, asset management, pension, or investment management environments strongly preferred.

The expected annualized base salary range for this role is $155,000 – $175,000.

Based on the position, QuadReal offers a competitive total rewards package in addition to the base pay, which may include a performance-based incentive plan, comprehensive health & dental benefits, pension plan, and paid time off.

The actual salary offered will take into consideration a wide array of factors including, but not limited to, the individual’s skill, experience, education and training, the market compensation of the role, and the consideration to internal equity.

We value diverse experiences and perspectives. Even if your skills don’t align 100% with the listed qualifications or salary range, we encourage you to apply – you may be a great fit for this role or others in our community. Applicants may also be considered for alternative positions within the organization where their qualifications and experience align more closely with available opportunities.

We use artificial intelligence (AI) technology — alongside human review — to assist in screening and assessing applicants for this position. Our recruitment team remains involved in all decisions.

Candidates must be legally authorized to work in Canada as the company does not provide work permit sponsorship for this role.

Note to Recruiters: QuadReal does not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to QuadReal, directly or indirectly, will be considered QuadReal property. QuadReal will not pay a fee for any placement resulting from the receipt of an unsolicited resume. A recruiting agency must first have a valid, written and fully executed agency agreement contract for engaged services to submit resumes.

QuadReal Property Group will provide reasonable accommodation at any time throughout the hiring process for applicants with disabilities or for those needing job postings in an alternate format. If you require accommodation, please advise the Talent Acquisition team member you are working with and include the following: Job posting #, your name and your preferred method of contact.