Security GRC Specialist - SOC 2 & ISO 27001 Compliance

Equisoft Inc. (Canada); Montreal; Hybrid; CAD 90,000 - 130,000; Full time

Benefits offered by this job

Educational Support

Medical

Dental

Retirement Plan

Telemedicine Program

Employee Assistance Program

etc.

Job summary

Equisoft is seeking a Specialist, Security Assurance and Compliance to join our Quebec City hub. This hybrid role focuses on governance, evidence collection, and automation to support audits and control activities across teams you don’t manage.

You’ll coordinate SOC 2, ISO 27001, ISO 22301, and ISO 42001 programs, lead DPIA reviews, manage vendor risk, and drive quarterly access reviews and vulnerability remediation with a strong emphasis on documentation and process improvement.

Qualifications

• 5+ years in InfoSec GRC or IT audit in software/regulated services.
• Hands-on ownership of at least one full SOC 2 Type II or ISO 27001 cycle.
• Experience with B2B client security questionnaires/due diligence.
• Working knowledge of GDPR, Quebec Law 25, and PIPEDA.
• Fluent in French and English for international coordination.

Responsibilities

• GRC: support SOC 2, ISO 27001, ISO 22301, and ISO 42001; control mapping, evidence collection, auditor liaison.
• Vendor risk: manage the end-to-end DPIA process, DPA/sub‑processor analysis, SCC/residency checks, risk rating.
• Client security: complete due diligence questionnaires and RFP security sections; coordinate audit evidence requests.
• Identity governance: own quarterly access reviews (OIPA, Design, SQL, Azure) and automation with MSP.
• Vulnerability & pentest: track findings, drive remediation tickets, coordinate annual pentest.
• Patch & config: monthly patching tickets and inventory maintenance.
• Security awareness: run training cycles and report completion.
• BCDR: provide evidence for drills and continuity exercises.

Skills

InfoSec GRC

IT audit

GDPR knowledge

French & English

Tools

Tenable

SentinelOne

Azure

SQL

Power Automate

Job description

Equisoft is seeking a Specialist, Security Assurance and Compliance to join our Quebec City hub. This hybrid role focuses on governance, evidence collection, and automation to support audits and control activities across teams you don’t manage.

You’ll coordinate SOC 2, ISO 27001, ISO 22301, and ISO 42001 programs, lead DPIA reviews, manage vendor risk, and drive quarterly access reviews and vulnerability remediation with a strong emphasis on documentation and process improvement.