Governance and Compliance Specialist

COFOMO; Montreal (administrative region); Hybrid; CAD 80,000 - 110,000; Full time

Job summary

COFOMO seeks a Governance and Compliance Specialist in Montréal to advance security posture management. You will craft standards, analyze risks, and present executive-level findings to decision-makers.

The role requires strong policy experience and cross-functional collaboration with IT, risk, and compliance teams. The successful candidate will work in a hybrid Montreal environment, with a focus on financial/regulatory contexts and cloud security considerations.

Qualifications

• Minimum seven (7) years of governance, risk management and compliance experience in information technology or cybersecurity.
• Experience in a financial institution or highly regulated environment.
• Experience writing and maintaining security policies, guidelines and standards.
• Experience drafting waivers or exceptions to security or governance requirements.
• Familiarity with frameworks such as NIST CSF, NIST SP 800-53, ISO 27001 or COBIT.
• Ability to work with technical and business teams.
• Bachelor's degree or certificate in cybersecurity, information technology, or related field.
• Certifications such as CISA, CRISC, CGEIT or CISSP are assets.
• Strong knowledge of security posture management and cloud security concepts.
• Excellent analytical, documentary, and workshop facilitation skills.
• Ability to deliver strategic recommendations based on risk and best practices.

Responsibilities

• Design and evolve the security posture management framework in accordance with industry guidance.
• Develop and maintain standards derived from the Security Posture Management Directive.
• Prepare analyses and executive presentations summarizing risks and decisions.
• Update information security governance documents and policy library.
• Collaborate with technology, risk, compliance, and vendor teams to support objectives.
• Contribute to continuous improvement of information security processes and governance practices.

Skills

Governance

Risk management

Compliance

Information security

Policy writing

Frameworks (NIST CSF)

Auditing

Communication

Stakeholder engagement

Education

Bachelor's degree in cybersecurity/IT or related field

Certifications (CISA/CRISC/CGEIT/CISSP) Asset

Job description

# Governance and Compliance SpecialistMontrealHybridCybersecurity and Identity ManagementApplyWith over 30 years of recognized expertise, COFOMO is now a leading Canadian consulting firm specializing in digital and artificial intelligence. Supported by more than 3,000 experts, 10 Centers of Excellence, and 4 offices across the country, we are uniquely positioned to successfully guide our clients through their transformations. Both strategic and tactical, we help organizations across a wide range of industries thrive in today’s rapidly evolving world.## Our promiseHelp our clients succeed and maximize the impact of their transformation initiatives, turning them into powerful drivers of growth and innovation.## Job description**Here's a brief overview of the tasks and responsibilities you'll have :*** Design and evolve the security posture management framework in accordance with industry-recognized organizational guidance and frameworks;* Develop and maintain standards derived from the Security Posture Management Directive;* Analyze, document and draft requests for exceptions to security requirements and ensure their presentation to the appropriate decision-making bodies;* Prepare analyses, reports and executive presentations summarizing findings, risks, recommendations and required decisions;* Participate in the development, review and update of information security governance documents, including policies, directives, standards and other normative documents;* Review and update the library of security controls to ensure alignment with regulatory requirements, emerging risks, and applicable compliance frameworks;* Collaborate with technology, cybersecurity, risk management, compliance, project teams and vendors to support governance and information security objectives;* Contribute to the continuous improvement of information security processes, management frameworks and governance practices;* Participate in third-party risk assessments and make recommendations to reduce identified risks;* Implement a process for managing exceptions to the security requirements prescribed in governance documents;* Ensure that governance documents and the security control library are updated as needed;* Produce executive materials presenting findings, risks, recommendations and decisions to be made. **The profile we are looking for is as follows:*** Have a minimum of seven (7) years of experience in governance, risk management and compliance in information technology or cybersecurity;* Experience in a financial institution or a highly regulated environment;* Have experience in writing and maintaining security policies, guidelines and standards;* Master the drafting of waivers or exceptions to security or governance requirements;* Be familiar with one or more recognized frameworks such as NIST CSF, NIST SP 800-53, ISO 27001 or COBIT;* Demonstrate experience working with technical and business teams;* Hold a bachelor's degree or certificate in cybersecurity, information technology, computer engineering, information systems, business administration with a specialization in IT, audit, risk management or a related field;* Have CISA, CRISC, CGEIT or CISSP certification (an asset);* Master cybersecurity governance, risk management, and compliance principles;* Understand security posture management practices;* In-depth knowledge of cybersecurity frameworks and frameworks, including NIST CSF and NIST SP 800-53;* Understand concepts related to security controls, exception management, compliance, and auditing;* Knowledge of the regulatory context applicable to financial institutions (an asset);* Understand the cybersecurity issues associated with cloud environments (an asset);* Demonstrate an ability to popularize technical concepts to different audiences;* Formulate strategic recommendations based on risks and industry best practices;* Excellent analytical, synthetic, documentative, communicative and workshop facilitation skills;* Demonstrate autonomy in the realization of mandates and the production of deliverables.