IT and Cybersecurity Risk Analyst

Skillhub Solutions Inc.; Dorval; On-site; CAD 70,000 - 100,000; Full time

Job summary

Air Canada is seeking an Analyst, IT & Cybersecurity Risk to support cybersecurity risk management and compliance across applications, projects, vendors, and processes.

The role involves conducting risk assessments, evaluating third-party risk during onboarding and contracting, and reviewing assurance materials such as SOC reports and ISO 27001 certifications. You will document findings, collaborate with cross-functional teams, and help improve risk governance.

Qualifications

• University degree in information security, information technology, computer science, risk management, or related discipline, or equivalent experience.
• 2–4 years in cybersecurity, IT risk, IT compliance, IT audit, governance, or third-party risk.
• Experience with risk assessments, control reviews, compliance activities, and vendor security.
• Understanding of internal controls, ITGCs, SOC 1/2, PCI DSS, ISO 27001.
• Familiarity with NIST, COBIT, SOX, GDPR, PIPEDA, or GRC platforms is an asset.

Responsibilities

• Conduct cybersecurity risk assessments for applications, systems, projects, and technology initiatives.
• Assess third-party cybersecurity risks during vendor onboarding, contract reviews, renewals, and ongoing monitoring.
• Review vendor assurance materials (SOC, ISO 27001, pen tests, security questionnaires).
• Document and communicate risks, gaps, remediation recommendations, and exceptions; follow up on remediation.
• Work with Procurement, Legal, Privacy, Compliance, and stakeholders on third-party risks and contract security requirements.
• Support third-party cybersecurity incident reviews and maintain assessment records in GRC platforms.
• Support compliance and control assurance including ITGCs, PCI DSS, SOC 1/2, ISO 27001, privacy, audit evidence, findings tracking.
• Maintain risk registers, dashboards, metrics, and management reporting.
• Prepare risk summaries, assessment reports, dashboards, and presentations, and help improve risk and compliance processes.

Skills

Analytical skills

Communication skills

Problem-solving

Stakeholder management

Risk assessment

Education

University degree in information security or related field

Tools

Archer

Optro

AuditBoard

MetricStream

Job description

Air Canada is hiring an Analyst, IT & Cybersecurity Risk to support cybersecurity risk management and compliance programs. The role assesses technology and third-party risks and supports control assurance across applications, projects, vendors, and operational processes.

Responsibilities

• Conduct cybersecurity risk assessments for applications, systems, projects, and technology initiatives.
• Assess third-party cybersecurity risks during vendor onboarding, contract reviews, renewals, and ongoing monitoring.
• Review vendor assurance materials, including SOC reports, ISO 27001 certifications, penetration test reports, and security questionnaires.
• Document and communicate risks, control gaps, remediation recommendations, and exceptions; follow up on remediation activities.
• Work with Procurement, Legal, Privacy, Compliance, and business stakeholders on third-party risks and contract security requirements.
• Support third-party cybersecurity incident reviews and maintain assessment records in GRC platforms.
• Support compliance and control assurance, including IT General Controls, PCI DSS, SOC 1, SOC 2, ISO 27001, privacy, audit evidence, and findings tracking.
• Maintain risk registers, compliance dashboards, metrics, and management reporting.
• Prepare risk summaries, assessment reports, dashboards, and presentations, and help improve risk and compliance processes.

Qualifications

• University degree in information security, information technology, computer science, risk management, or a related discipline, or equivalent practical experience.
• Two to four years of experience in cybersecurity, IT risk, IT compliance, IT audit, governance, third-party risk, or a related field.
• Experience with cybersecurity risk assessments, control reviews, compliance activities, third-party risk processes, or vendor security assessments.
• Understanding of internal controls, IT General Controls, SOC 1, SOC 2, PCI DSS, or ISO 27001.
• Familiarity with frameworks such as NIST, COBIT, SOX, GDPR, and PIPEDA, or GRC platforms such as Archer, Optro, AuditBoard, or MetricStream, is an asset.
• Strong analytical, organizational, investigative, written communication, and problem‑solving skills; ability to communicate technical risks to business stakeholders and manage competing priorities.

Conditions of employment

Candidates must be eligible to work in the country of interest when an offer is made and provide proof of eligibility before their start date. Based on equal qualifications, preference will be given to bilingual candidates.

Air Canada is an equal opportunity employer committed to diversity, inclusion, and an accessible and rewarding work environment. Only candidates selected to continue in the process will be contacted.