Director, Governance, Risk & Compliance (GRC)

Robertson & Company Ltd.; Toronto; Hybrid; CAD 175,000 - 190,000; Full time

Job summary

Robertson & Company Ltd. seeks a Director of Governance, Risk and Compliance to lead the design and execution of comprehensive GRC strategies.

You will own the Enterprise Cyber Risk Framework and oversee risk registers across cybersecurity, data privacy, and third-party risk, reporting to executive leadership. The role partners with Legal, Privacy and IT to speed business growth through compliant vendor assessments, audit readiness, and alignment with NIST, ISO 27001 and financial regulations.

Qualifications

• 10+ years of experience in cybersecurity, information security, technology risk, IT controls, or related disciplines
• 5+ years of direct Governance, Risk & Compliance (GRC) experience
• 3+ years of leadership experience within cybersecurity, technology risk, or compliance functions
• Experience working within regulated industries such as financial services, banking, fintech, insurance, payments, or wealth management

Responsibilities

• Own and operate the Enterprise Cyber Risk Framework and maintain risk registers across cybersecurity, technology, data, and third-party vendors
• Translate complex risks into executive-level reporting, heatmaps, and KRIs for the CISO
• Mature policies, optimize GRC workflows, validate control effectiveness, and coordinate audits against NIST, ISO 27001, and financial regulatory requirements
• Partner with Legal, Privacy, and IT to streamline vendor risk assessments and customer due diligence for rapid growth

Skills

Cybersecurity

GRC leadership

Regulatory reporting

Executive stakeholder management

Job description

Location:

Hybrid (Downtown, Toronto) 2-3x/week

Employment Type:

Permanent, Full-Time

Compensation:

$175,000 - CA$190,000 Base

Overview:

Our client, a leader in the industry, is seeking a dedicated Director of Governance, Risk, and Compliance to join their team. In this role, you will lead efforts to develop and implement comprehensive governance and compliance strategies, ensuring the organization meets regulatory standards and industry best practices.

What you will achieve in this role:

Full Program Ownership: Y

ou will directly own and operate the clients Enterprise Cyber Risk Framework and maintain active risk registers spanning cybersecurity, technology, data, and third-party vendors.

High Visibility with Leadership:

You will be responsible for translating complex risks into executive-level reporting, heatmaps, and KRI dashboards for the CISO and guide business decisions.

Hands-On Building & Modernization:

This isn't a passive governance job or a big-bank paper-pushing role. You’ll be hands-on—maturing policies, optimizing GRC workflows, validating control effectiveness, and coordinating audit readiness across NIST, ISO 27001, and financial regulatory requirements.

Enabling Commercial Speed:

You’ll partner closely with Legal, Privacy, and IT to streamline vendor risk assessments and customer due diligence, ensuring compliance supports rapid business growth without adding unnecessary red tape.

Required Qualifications:

• 10+ years of experience in cybersecurity, information security, technology risk, IT controls, or related disciplines
• 5+ years of direct Governance, Risk & Compliance (GRC) experience
• 3+ years of leadership experience within cybersecurity, technology risk, or compliance functions
• Experience working within regulated industries such as financial services, banking, fintech, insurance, payments, or wealth management

Demonstrated experience managing:

• Regulatory compliance initiatives
• Executive reporting and remediation tracking
• Strong understanding of enterprise cyber risk management practices and governance frameworks
• Experience supporting audits, regulatory reviews, and control validation activities
• Excellent communication and stakeholder management skills

Strong understanding of:

• Information security governance
• Identity & Access Management (IAM)
• Data protection and privacy controls
• Cloud security frameworks
• Vulnerability management
• Third-party risk management
• Business continuity and operational resilience

Preferred Qualifications:

• Experience within a Canadian financial institution, fintech, or other highly regulated environment
• Professional certifications such as: CISSP, CISM, CRISC, CGEIT, Or ISO 27001 Lead Implementer or Lead Auditor
• Experience implementing or enhancing GRC platforms and workflow automation solutions
• Familiarity with: PCI DSS, SOC 2, Cloud security control frameworks, Privacy compliance frameworks
• Experience mapping controls across multiple compliance and regulatory frameworks

Interviews:

• 2 Rounds

AI Disclosure:

Artificial Intelligence may be used as part of our application review process to assist in reviewing, screening and assessment of applicants. All applications are also reviewed by our recruitment team.

Additional Information:

Background screening is required as part of the onboarding process. The type of screening required (criminal, credit, or other verifications) will vary based on the position and client requirements.

Robertson & Company values diversity and is an equal opportunity employer committed to an inclusive and accessible recruitment process. Accommodations are available upon request throughout all stages of the hiring process.