Senior Security Analyst - Third Party Risk

Insight Global; Vancouver; On-site; CAD 100,000 - 120,000; Full time

Job summary

A leading cybersecurity firm in Canada is seeking an experienced cybersecurity professional to join their Governance Risk & Compliance team. Responsibilities include conducting IT risk assessments, managing stakeholder communications, and evaluating information security risks. The ideal candidate has at least 8 years of IT risk management experience and relevant certifications such as CISSP or CISA. This role fosters a diverse and inclusive workplace culture.

Qualifications

• Minimum 8-10 years IT risk management or IT-GRC experience.
• Experience with data security and privacy regulations like NIST CSF, ISO 27001.
• Ability to assess technology risk of third-party vendors.

Responsibilities

• Perform IT Risk Assessments for new projects.
• Determine information security risk profiles for systems and data.
• Lead stakeholder management and risk communication.

Skills

IT risk management

Data security and privacy regulations

Stakeholder management

Communication skills

Education

Bachelor’s degree in Management Information Systems

CISSP certification

CISA certification

CRISC certification

ISO27001 LA certification

Tools

Confluence

Jira

Job description

Job Description

The Cybersecurity Governance Risk & Compliance team are cybersecurity experts, problem solvers, insight and solution generators, and trusted compliance advisors to the business. We leverage our risk, information security and control expertise to support risk management, IT Security, Regulatory Compliance and to drive continuous process improvements and cost savings. We also partner with various parts of the business (Brand, Product, IT, and Finance, to name a few) and engage in open dialogue to tap into the creativity of our people and action innovative solutions. Some responsibilities include:

• Participate in performing IT Risk Assessments of all new projects and technology implementations.
• Determine information security risk profiles for various systems, assets, data etc., using knowledge of lululemon policy, frameworks, standards and relevant industry best practices.
• Ability to characterize the system, identify threats / vulnerabilities, control deficiencies, likelihood determination, impact analysis, risk levels, compensatory control recommendation and results documentation.
• Escalate security risk exceptions, threats, vulnerabilities, quality, performance, gaps, change control and delivery issues as required.
• Ability to lead stakeholder management, risk communication, risk reviews, driving risk acceptance and risk treatment activities.
• Execute automation in applying GRC work flows, tracking risk life-cycle, engaging stakeholders, monitoring and reporting risks.
• Collaborates with other members of the Policy, IT Security & Risk Assessment team on complex matters.
• Identifies needs, develops and implements technology-related continuous improvement initiatives for the department.

We are a company committed to creating diverse and inclusive environments where people can bring their full, authentic selves to work every day. We are an equal opportunity/affirmative action employer that believes everyone matters. Qualified candidates will receive consideration for employment regardless of their race, color, ethnicity, religion, sex (including pregnancy), sexual orientation, gender identity and expression, marital status, national origin, ancestry, genetic factors, age, disability, protected veteran status, military or uniformed service member status, or any other status or characteristic protected by applicable laws, regulations, and ordinances. If you need assistance and/or a reasonable accommodation due to a disability during the application or recruiting process, please send a request to [e-mail]. To learn more about how we collect, keep, and process your private information, please review Insight Global's Workforce Privacy Policy: https://insightglobal.com/workforce-privacy-policy/.

Skills and Requirements

• Minimum 8-10 years IT risk management experience or a combination of IT-GRC and information security experience
• Knowledge/experience with data security and privacy regulations (e.g. NIST CSF, ISO 27001, PCI DSS, GDPR).
• Experienced identifying, assessing and creating solutions surround technology and security risk
• Experience assessing technology risk of third party vendors
• Very strong stakeholder management skills and able to present and answer questions in front of large groups of senior management and executives
• Excellent documentation (confluence, jira)
• Excellent communication skills
• Bachelor’s degree (preferably Management Information Systems). At least one of the following professional certifications: CISSP, CISA, CRISC, or ISO27001 LA