Software Risk and Compliance Analyst

Bis; Sherwood Park; On-site; CAD 90,000 - 120,000; Full time

Benefits offered by this job

ESOP

Health, dental and vision

Life insurance

Disability insurance

Health spending account

Flexible working hours

On-the-job training and growth

Free on-site parking

Job summary

BIS Safety Software is seeking a Software Risk and Compliance Analyst to partner with product and tech teams in Sherwood Park, AB. You will own risk assessments for new features, ensure data flows stay compliant, and help validate controls throughout development.

You will be involved in early design discussions, audit readiness, and practical solutions to keep work moving while meeting privacy and governance commitments.

Qualifications

• Background in risk, compliance, privacy, or data governance.
• Experience with control frameworks such as SOC 2, PCI DSS, GDPR.
• Willing to speak up and stay with it in a cross-functional setting.
• In-person role based out of the Sherwood Park, AB office.
• Experience in a software or SaaS company.

Responsibilities

• Own risk assessments for new features, data handling, and changes.
• Join feature mapping early to surface risk and capture requirements.
• Follow cases through full life cycle, monitor scope creep, keep approvals valid.
• Verify via hands-on use of the software that controls match documentation.
• Support audit readiness ahead of SOC 2 and PCI DSS cycles and close gaps.

Skills

Risk management

Privacy

Data governance

Compliance

Detail oriented

Analytical mindset

Auditing

Education

Post-secondary education in compliance, information security, CS or engineering

Tools

Project management tools

Ticketing systems

Job description

BIS Safety Software is a SaaS company on a mission to change how organizations manage safety, learning, and compliance. Since 2006 we've been building software in a space where trust and data integrity matter, and we're looking for a Software Risk and Compliance Analyst who will be embedded with our technology and product teams, focused entirely on the software itself.

About the Role

You’ll be in the room with product and technology every day, knowing the software as well as the people building it, and making sure that new modules, feature improvements, and changes to how data moves keep us aligned with PCI DSS, SOC 2, GDPR, and the data governance commitments we make to our clients.

Risk gets identified while a feature is still being sketched out, the right requirements land in the case up front, and nothing stalls later because a compliance question surfaced too late. When scope shifts partway through, you're the one who notices that what was approved is no longer what's being built.

You’ll have the autonomy to raise a concern to anyone here, and we'll expect you to use it. We'll also expect you to bring a way forward. The job is enablement, not gatekeeping, and the difference matters to us.

You’ll spend a lot of your time in project tickets and inside the software. The people who love this role are the ones who find that genuinely interesting.

This is an in-person role based out of our Sherwood Park, AB office.

• Risk assessments: own the assessments for new features, new modules, and any change to how our software collects, stores, or moves data.
• Early involvement: join feature mapping and product planning sessions, ask the questions that surface risk before development starts, and get the right requirements written into the case.
• Ticket to ship: follow cases through their full life, watch for scope creep, and re-review when something changes so approvals stay valid.
• Hands-on verification: work in the software yourself to confirm it behaves the way our documentation and our controls say it does.
• AI features: assess how AI capabilities in our product handle personal data, where that data is processed, and whether it stays within the boundaries we've committed to.
• AI in the build: join the conversations about how we connect AI tools to our data, asking where information gets processed, what a model can reach, and how it stays contained.
• Audit readiness: review what has changed ahead of our SOC 2 and PCI DSS cycles, confirm our controls still match reality, and close gaps before an auditor finds them.
• Practical solutions: partner with developers and product to find a compliant path forward so work keeps moving.
• Experienced with a background in risk, compliance, privacy, or data governance
• Detail-oriented to an unusual degree, the person who reads a case and catches what nobody addressed
• Experienced in digging until you actually understand it, especially when it comes to how data moves through a system
• Willing to speak up and stay with it, raising a concern clearly and following through until it's resolved
• Able to see the second-order impact, the other module, the other commitment, the thing this quietly touches
• Following AI and privacy developments on your own, closely enough to spot when a new capability changes the risk picture
• Drawn to technology and happy spending your days in project tickets and software
• Curious about how AI works underneath the demo, enough to ask whether a tool is doing what it claims with our data
• Self-directed, comfortable with autonomy and setting your own priorities
• Solution-minded, arriving with options rather than only objections
• A background in risk, compliance, privacy, data governance, or information security.
• Working familiarity with at least one control framework or privacy regime, such as SOC 2, PCI DSS, GDPR, ISO 27001, or something comparable
• Strong technical aptitude and real curiosity about how software works under the hood, including how data is stored, transmitted, and shared between systems
• Experience with the privacy and data governance questions that come with AI features: what data a model can reach, where it's processed, and what leaves our environment.
• Comfort working day to day in project management and ticketing tools, following a case from scoping through to release
• Post-secondary education in a relevant field, such as compliance, information security, computer science, or engineering, or equivalent hands‑on experience
• A background in software engineering or QA/QC
• Experience with AI governance, or a genuine interest in the privacy and data questions that come with AI features
• Experience working inside a software or SaaS company

• Employee Stock Ownership Plan (ESOP)
• Full medical, dental, and vision coverage
• Life insurance and disability insurance
• Health spending account
• Flexible working hours
• On-the-job training and growth opportunities
• Free on-site parking

About BIS:

BIS Safety Software has been headquartered in Sherwood Park, Alberta, since 2006. We build software that helps organizations manage safety training, learning, and compliance - and we’re growing!

A few things that make us different: we don’t use job titles internal� - we value humility and contribution over hierarchy. We move fast, integrate new ideas quickly, and give people real ownership of their work. And through our Employee Stock Ownership Plan (ESOP), you have the opportunity to own a piece of the company you’re helping build.

Job ID #T202609-03CRC