IT Risk and Compliance Analyst

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a IT Risk and Compliance Analyst based in Canada.

This role supports the day-to-day execution of a growing IT risk, compliance, privacy, and governance program.
You will work across contracts, security questionnaires, control evidence, vendor risk, data retention, and compliance policies.
The position offers the opportunity to help shape a program being rebuilt from the ground up and establish scalable ways of working.
You will collaborate with Legal, IT, Delivery, leadership, vendors, and other stakeholders to translate requirements into practical controls and actions.
The role combines technical and legal concepts with hands-on program coordination, risk management, and process improvement.
Success requires exceptional organization, strong written communication, sound judgment, and the ability to manage multiple priorities independently.
This is an ideal opportunity for a compliance professional who enjoys ownership, variety, and building effective processes within a collaborative environment.

• Review client MSAs, SOWs, DPAs, security addenda, and related agreements using contract analysis tools, identifying provisions requiring attention from Legal, IT, Delivery, or other stakeholders and coordinating redlines through completion.
• Translate contractual security, privacy, data handling, audit, breach notification, and sub-processor requirements into trackable operational commitments and verify that obligations are being met.
• Respond to client security questionnaires, due diligence requests, and audit inquiries while maintaining and improving a reusable knowledge base to make future responses faster and more consistent.
• Collect, organize, maintain, and manage control evidence within the GRC platform, tracking remediation activities against frameworks such as SOC 2, ISO 27001, NIST CSF, and other applicable standards.
• Support vendor risk management activities for SaaS and AI providers by reviewing security documentation, DPAs, sub-processor information, and findings, while maintaining accurate vendor risk records.
• Operationalize data retention and disposal requirements by tracking departmental retention schedules, documenting exceptions and legal holds, and working with IT to verify retention settings across relevant platforms.
• Support privacy program activities including data mapping, data subject request processes, and monitoring obligations associated with GDPR, CCPA, and other applicable privacy requirements.
• Draft, maintain, publish, and improve compliance policies, standard operating procedures, and process documentation, ensuring that requirements remain current and are effectively implemented.
• Prepare risk and compliance reporting for leadership, highlighting program status, emerging risks, remediation progress, and areas requiring attention.
• Maintain and monitor the risk register, support annual risk assessments, and contribute to the identification, evaluation, and treatment of organizational risks.
• Participate in business continuity and disaster recovery planning, tabletop exercises, security incident response, internal audits, access reviews, and periodic control testing.
• Administer security awareness training programs and monitor completion and compliance across the organization.

Requirements

• Bachelor’s degree or equivalent practical experience, with 3–5 years of professional experience in compliance, GRC, contract management, privacy, risk, or a related field.
• Hands-on experience reviewing commercial agreements, ideally including MSAs, DPAs, security addenda, or similar documents, with the ability to collaborate effectively with legal counsel on contractual redlines.
• Experience responding to client security questionnaires, vendor due diligence requests, audit inquiries, or comparable compliance information requests.
• Working knowledge of at least one major security or compliance framework, such as SOC 2, ISO 27001, or NIST CSF, including a practical understanding of the evidence required to demonstrate control effectiveness.
• Foundational understanding of data privacy regulations such as GDPR and CCPA, particularly how privacy requirements translate into contracts, operational processes, and compliance obligations.
• Exceptional organizational and follow-through skills, with the ability to manage numerous parallel workstreams, deadlines, stakeholders, and remediation activities without losing attention to detail.
• Clear, concise, and confident written communication skills, including the ability to interpret complex technical or legal information and distill it into practical priorities and recommendations.
• Strong analytical, problem-solving, and judgment skills, with the ability to identify gaps, assess risks, coordinate solutions, and follow issues through to resolution.
• Comfortable working with SaaS platforms, GRC systems, contract analysis tools, and other technology, with a demonstrated ability to learn new systems quickly and use technology to improve processes.
• Self-directed and accountable, with the ability to own outcomes end to end while working effectively within a small, collaborative team.
• Comfortable working across technical, legal, operational, and business functions and translating requirements between different stakeholder groups.

Benefits

• Salary range of $80,000–$90,000 USD.
• Remote working arrangement within the United States.
• Opportunity to help build and shape an IT risk and compliance program from the ground up.
• Broad exposure to IT risk, compliance, privacy, vendor management, contracts, security operations, and governance.
• Collaborative and inclusive work environment that values diverse perspectives and authentic contributions.
• Opportunities to work closely with cross-functional teams across legal, technology, delivery, security, and leadership functions.
• Meaningful ownership and autonomy within a growing compliance program.
• Opportunity to contribute to process improvement and the development of scalable compliance practices.

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1