Senior GRC Analyst

Job description

**What we're all about.** It isn’t often you get to be part of a tech company that, since 2016, has been innovating the data analytics market in ways no-one else can. Our technology started out in FinTech, helping tackle serious criminal activity. Now, its potential is virtually limitless. Working at Quantexa isn't just intellectually stimulating. We’re a real team. Collaborating and constantly engineering better solutions. We’re ambitious, we think things through and we’re on a mission to discover just how far we​ can​ go. ​​​Nearly half​ of our colleagues come from an ethnic or religious minority background. ​​We’re made up of people from 47 nationalities who speak over 20 languages. As a diverse mix of individuals, we make one big unstoppable team. ​ ​ **We're heading in one direction, the future. We’d love you to join us.** **Location.** Quantexa is looking for an experienced Senior GRC Analyst to support our growing business. This role will be based in Toronto/Ottawa and will require travel to customer sites and other Quantexa offices where appropriate. It can be structured a hybrid role depending on your location. **The opportunity.** Information Security Governance, Risk and Compliance is a key part of how Quantexa manages security across the organisation. Our approach focuses on effective security governance, proactive risk management, regulatory and contractual compliance, independent assurance and the continual improvement of our Information Security Management System. This is a governance focused security role requiring a solid understanding of technical security, cloud environments and modern software development, combined with practical experience across security governance, risk management, compliance and customer assurance. As part of the role, the successful candidate will serve as Quantexa’s Alternate Company Security Officer (ACSO), supporting our obligations and the current Company Security Officer (CSO) under applicable Canadian Government security requirements. When appointed this will include responsibilities relating to personnel and organisational security, contractual security requirements, and the protection of Government of Canada information and assets in line with the Contract Security Manual (CSM). The role sits within Quantexa’s global Information Security function, headquartered in London, England, and will initially report to the Head of Information Security. As our Canadian focal point for security governance, the successful candidate will own Canadian Government and customer security requirements while applying Quantexa’s global policies, frameworks and assurance activities. The successful candidate will also engage with customers, government bodies, security authorities and external assessors, supporting the coordination of security and compliance requirements across our global operations. **What you’ll be doing.** **Government Experience, Knowledge, and Skills** - Supporting the Company Security Officer (CSO) and perform responsibilities associated with Quantexa's Alternate Company Security Officer (ACSO) function. - Supporting compliance with applicable government security requirements, including the Public Services and Procurement Canada (PSPC) Contract Security Program and Contract Security Manual. - Managing and own the clearance requests, security briefings, security incidents and debriefings in line with the Contract Security Manual (CSM). - Reviewing commercial and government contracts, security clauses and procurement documentation to identify applicable requirements, and support their interpretation and implementation. **Information Security Governance, Risk and Compliance** - Ensuring regulatory, government, contractual and customer security requirements are identified, assessed and appropriately reflected in Quantexa's security controls and governance arrangements. - Monitoring relevant regulatory and government security requirements, assessing their impact on Quantexa and recommending necessary changes. - Maintaining, following and implementing Quantexa's global information security policies, standards and governance requirements within the business. - Supporting continual improvements of Quantexa's security governance framework, incorporating findings from audits, incidents, risk assessments, and evolving regulatory and customer requirements. **Customer, Government and Supplier Assurance** - Acting as a named security contact for relevant Government departments, customers and security authorities where required. - Supporting customer and government security assurance activities, including due diligence, security assessments, questionnaires and evidence requests. - Supporting third-party and supplier security risk assessments, ensuring identified risks are appropriately documented, escalated and managed. - Maintaining and improving reusable security assurance materials and supporting evidence to promote consistency, reduce duplication and improve response efficiency across customer, partner and government assessments. **Audit, Certification and Control Assurance** - Supporting internal and external audits, certification activities and ongoing compliance assessments, including ISO/IEC 27001, SOC 2, PCI-DSS, NIST SP 800-53r5, NIST SP 800-218, ISO/IEC 20243 and other applicable assurance frameworks. - Tracking audit findings, control deficiencies and remediation activities, ensuring appropriate ownership, timely resolution and reporting to relevant stakeholders. **Technical Security Governance** - Working with internal and client technical and operational teams to assess control effectiveness, coordinate testing and obtain appropriate evidence of compliance. **Cross-Functional Partnership** - Working with Legal and Commercial teams to review contractual information security requirements, assess associated risks and identify obligations requiring further action. - Working with the global information security function to provide clear reporting on security risks, compliance obligations, control effectiveness and remediation progress. **What you’ll bring.** - 8+ years in information security governance, risk, compliance or security assurance, across global frameworks and regulated government environments - Experience with government security requirements personnel screening, organizational security, and contractual obligations - A solid track record running security risk assessments, audits, control testing, and remediation - A solid working knowledge of ISO/IEC 27001, SOC 2, NIST SP 800-53 (or equivalent) and enterprise/cloud security controls - Strong communication skills, comfortable engaging senior stakeholders, auditors, and government representatives - Experience operating within a global security function while owning Government specific requirements - A strong technical communication ​ability​ with demonstrable experience of working in rapidly changing client environments. - Experience coordinating multiple concurrent compliance initiatives across engineering and business stakeholders. - Experience partnering closely with Privacy and Legal teams on regulatory compliance initiatives. - Experience managing control evidence, remediation programs, and continuous compliance activities. - Strong project management and organizational skills with the ability to manage competing priorities. - Excellent written and verbal communication skills, with the ability to translate complex compliance requirements into practical business guidance. **Nice to haves.** - Professional certifications such as CISSP, CISA, CRISC, CISM, HITRUST CCSFP, PCI ISA/QSA, or ISO 27001 Lead Auditor. - Prior experience in a high-growth and fat-paced FinTech/SaaS/enterprise software environments. Knowledge of privacy regulations (PIPEDA, GDPR) alongside security frameworks​. **Security Clearance.** This position requires an active Government of Canada Secret (Level II) security clearance, or the ability to obtain and maintain this clearance through the Government of Canada Contract Security Program (CSP). Obtaining and maintaining the required security clearance is necessary to perform applicable Government of Canada contract work. Security screening processing times are determined by the Government. Quantexa does not control the outcome or timeline and further information on the requirements and process can be found via the following link: [Government of Canada – Security Clearance Overview](https://www.canada.ca/en/public-services-procurement/services/industrial-security/security-requirements-contracting/personnel-security-screening/overview.html) Successful completion of the required security screening is a condition of employment.​ **Our perks and quirks.** What makes you Q will help you to realize your full potential, flourish and enjoy what you do, while being recognized and rewarded with our broad range of benefits. **We offer:** Competitive salary + bonus 100% RRSP match up to 5% Competitive annual leave, plus your birthday off, parental leave, PTO, and observed holidays Comprehensive benefits coverage, including mental health support, fitness reimbursements, and financial well-being Tax-advantageous benefits, such as commuter benefits, healthcare, and dependent care Regularly bench-marked salary rates Well-being days Volunteer Day off Work from Home Equipment Free Subscription to a meditation, relaxation and sleep app Continuous Training and Development Spend up to 2 months working outside of your country of employment over a rolling 12-month period with our ‘Work from Anywhere’ policy Team Social Budget & Company-wide Socials **Our mission.** We have one mission. To help businesses grow. To make data easier. And to make the world a better place. We’re not a start-up. Not anymore. But we’ve not been around that long either. What we are is a collection of bright, passionate minds harnessing complexities and helping our clients and their communities. One culture, made of many. Heading in one direction – the future. **It’s all about you.** We want you to feel welcome, valued, and respected - because it’s your individuality and passion that make you *Q*. We see that, and we celebrate it. That’s why we’re proud to be an Equal Opportunity Employer. We are committed to fostering an inclusive and diverse work environment, continuously improving to ensure everyone belongs. Our recruitment process is designed to be inclusive and accessible. **If you need any reasonable adjustments or accommodations, please let our Talent Acquisition Team know - we’re happy to assist.** No matter your race, beliefs, color, national origin, gender, sexual orientation, age, marital status, neurodiversity, or abilities—whoever you are—if you're a passionate, curious, and caring human eager to push the boundaries of what’s possible, we want to hear from you.