Senior GRC Analyst — Security & Compliance (Remote)

Shift Technology; Montreal (administrative region); Hybrid; CAD 167,000 - 209,000; Full time

Job summary

Shift Technology is seeking a Senior GRC Analyst to drive governance, risk management, and compliance across our security program. You will develop and maintain policies, oversee DPIAs, and coordinate internal and external audits to ensure regulatory obligations are met. The role reports to the GRC Lead within Information Security.

Ideal candidates have 7+ years in GRC or IT audit, and hold or pursue relevant certifications; experience with Drata and global privacy regulations is a plus.

Qualifications

• 7+ years of experience in GRC, IT Audit, Security Assurance, or Information Security.
• Bachelor’s Degree in a relevant field or equivalent work experience.
• Certifications in security and privacy are highly desirable (CIPP/E, CIPP/US, CIPT, CISA, CISM, CRISC, CISSP).
• Experience delivering audits and certifications in highly regulated industries.

Responsibilities

• Translate Shift’s information security expectations into policies, standards, and procedures.
• Promote security/compliance awareness and act as SME across the organization.
• Develop and maintain privacy policies and notices in line with GDPR and global regs.
• Manage security assurance plans and third‑party assessments.

Skills

Communication

Stakeholder management

Project management

Analytical thinking

Education

Bachelor’s Degree or equivalent

Professional certifications (CIPP/E, CIPP/US, CIPT, CISA, CISM, CRISC, CISSP)

Tools

Drata

Job description

Shift Technology is seeking a Senior GRC Analyst to drive governance, risk management, and compliance across our security program. You will develop and maintain policies, oversee DPIAs, and coordinate internal and external audits to ensure regulatory obligations are met. The role reports to the GRC Lead within Information Security.

Ideal candidates have 7+ years in GRC or IT audit, and hold or pursue relevant certifications; experience with Drata and global privacy regulations is a plus.