Job Information
CBN Secure Technologies Inc. Senior IT Governance, Risk and Compliance Specialist and Auditor in Hybrid - Ottawa, Canada
Internal Job Title: Senior IT Governance, Risk and Compliance Specialist and Auditor
Job Type: Permanent, Full-Time
Job Location: 18 Auriga Drive, Ottawa ON
Work Model: Hybrid
Position Summary
As a Senior IT Governance, Risk and Compliance Specialist and Auditor in our Corporate Information Security group, you will play a central role in developing, delivering and managing risk and compliance programs spa n n ing our organization. You will participat e extensively in relevant IT S ecurity projects that support the needs of the organization.
CBN designs and develops industry leading solutions for the following domains: Border Security, Civil Identity, Driver Identification and Vehicle Information, Currency and Excise Control, and Lottery and Charitable Gaming. To learn more, visit www.cbnco.com .
What We Can Offer You
Compensation: We seek long term relationships with our employees and recognize and reward them with a competitive total compensation package that includes:
An industry leading defined contribution pension plan with company matching contributions (up to 5%) and payment of service fees,
Best-in-class health, medical and life insurance benefits;
Access to virtual and telehealth services and apps; and
Very progressive fertility, adoption and surrogacy benefits to support all definitions of family.
Career: As a knowledge-based organization we will provide you with a wealth of learning opportunities and challenging work that will grow your knowledge, skills and abilities. At CBN, we encourage and empower our employees to chart their own career path, putting you in control of your future.
Culture: Personal character is the foundation of our culture. CBN’s 7 Core Principles shape and guide our behaviours and underpin the sense of community you will experience at CBN. Equity, diversity and inclusivity are important to us as an organization, and we are committed to fostering and developing a work environment where every employee is treated with dignity and respect.
What You Will Do
Compliance Monitoring and Management:
Framework Implementation : Plan and f acilitate the development and implementation of emerging compliance programs as required by the organization .
Compliance: Design, develop, deliver and lead our compliance programs, ensuring our IT systems and procedures comply with industry standards and regulations such as ISO 27001, PCI, and SOC2.
Framework Evaluation: Create, evolve, implement and maintain risk and compliance frameworks. Update internal control frameworks, assess gaps, and work with cross-organizational stakeholders and external partners to maintain compliance.
Internal Policies: Create internal policies and procedures to meet emerging or evolving standards and as new technologies or threats are defined.
Risk Assessment and Management:
Risk Program: Develop and maintain our ongoing IT Security risk management program following CBN standard procedures. Set program objectives, develop schedules and establish expectations.
Identify and Evaluate Risks: Collaborate with cross-organizational stakeholders and SME’s throughout the business to continuously assess IT risks.
Risk Documentation: Document identified risks and communicate them to relevant cross-organizational stakeholders, updating risk registers, following up with risk owners and reporting to executive committees as necessary.
Audit Planning Execution and Reporting:
Design Audit Programs and Schedules: Create detailed internal audit plans and schedules that align with the organization’s compliance requirements.
Conduct Audits: Lead comprehensive audits of IT systems, applications, and processes to ensure they meet appropriate security and compliance standards.
Document Findings: Prepare detailed reports on audit findings, update registers, highlight areas of concern, and assess corrective actions to ensure they will meet compliance requirements.
Present to Management: Present findings to senior management , Executive and R isk a nd C ompliance C ommittees, ensuring transparency and accountability.
Technical Leadership
Support Other Compliance Resources: Provide guidance and support across our organization(s) and to other CBN compliance and risk resources, helping them develop their skills.
Training and Development: Coach junior compliance resources and other staff on IT audit and compliance practices and risk management.
Investigations: As required assist in investigating security events and participate in relevant root cause analysis development.
Continuous Improvement:
Process Enhancement: Continuously seek ways to improve processes and methodologies to enhance efficiency and effectiveness. Aid in the maturat ion and evolution of our company wide Governance, Risk and Compliance (GRC) tool.
Supervise Corrective Actions: Oversee the implementation of corrective actions to ensure compliance issues are resolved effectively and promptly.
Various Other Duties and Responsibilities
Qualifications
Knowledge and Experience
Bachelor’s degree in Information Systems (or similar) or equivalent combination of education and/or relevant work experience
Certification in a relevant audit discipline : e.g. BSI Lead Auditor, ISACA CISA, PECB Sr. Lead Auditor , PCI-ISA .
Certification in one (or more) of the following compliance frameworks : ISO27001-2013 /2022 , ISO 14298, NASPO, PCI-DSS v 4.0 SANS, ISACA .
Extensive experience in on (or more) of the following : SOC 1, SOC 2 (Type I and II), FedRamp , relevant ITSGs, CSA and CSA Star-II
Comprehensive knowledge in multiple domains, including IT infrastructure, risk management , compliance and auditing standards
Excellence in translating complex compliance requirements to business leaders.
Comprehensive knowledge of industry recognized threat and risk management methodologies (HTRA, TRA, TVRP, ITSG-33)
Comprehensive knowledge of Unified Compliance Frameworks and GRC tools
Thorough knowledge of current security trends, threat vectors and cyber security TTPs
8+ years of experience in a r elevant compliance, risk or auditing role
5+ years of experience in cyber and/or corporate security organization
5+ years of experience in developing and delivering compliance and risk assessments, creating, and presenting reports to executives and handling external auditors.
Experience in IT operations or IT infrastructure desirable
Soft Skills and Abilities
Critical thinking skills
Organization and time management skills
Interpersonal skills
Coaching skills
Teamwork and collaboration
Growth mindset
Mandatory Requirements
Fluency in English (fluency in Spanish is an asset)
Ability to travel domestically. 6-8 weeks/year
Security Clearance Requirements
Ability to obtain and maintain Government of Canada Secret (Level II) personal security clearance.
About Us
As an Equal Opportunity Employer, Canadian Bank Note Company, Limited is committed to achieving a skilled workforce that reflects the diversity of the Canadian population. We encourage applications from women, visible minorities, people with disabilities and Aboriginal people. Canadian Bank Note Company Limited is committed to developing inclusive, barrier-free selection processes and work environments.
If contacted regarding this competition, please advise the interview coordinator of any accommodation measures you may require.