IT and Cybersecurity Risk Analyst

About the role

Being part of Air Canada is to become part of an iconic Canadian symbol, recently ranked the best Airline in North America. Let your career take flight by joining our diverse and vibrant team at the leading edge of passenger aviation. The Analyst, IT & Cybersecurity Risk supports Air Canada's cybersecurity risk management and compliance programs. The role helps identify, assess, and manage cybersecurity and technology risks across applications, projects, third-party vendors, and operational processes, while supporting compliance and control assurance activities as required. The successful cand…

Requirements

• University degree in Information Security, Information Technology, Computer Science, Risk Management, or a related discipline, and/or equivalent practical experience.
• 2 to 4 years of experience in cybersecurity, IT risk management, IT compliance, IT audit, governance, third-party risk management, or a related field.
• Experience conducting cybersecurity risk assessments, control reviews, or compliance activities.
• Understanding of third-party risk management processes and vendor security assessments.
• Experience working with internal controls, IT General Controls (ITGCs), SOC 1, SOC 2, PCI DSS, or ISO 27001.
• Familiarity with cybersecurity and risk frameworks such as NIST, COBIT, SOX, GDPR, and PIPEDA is an asset.
• Familiarity with Governance, Risk and Compliance (GRC) platforms such as Archer, Optro, AuditBoard, MetricStream, or similar tools is an asset.
• Strong analytical, organizational, investigative, and problem-solving skills.
• Strong written and verbal communication skills, with the ability to communicate technical risks and control considerations to business stakeholders.
• Ability to manage multiple priorities and deadlines in a fast-paced environment.
• Collaborative working style, with the ability to build effective relationships across technical and business teams.
• Curiosity, sound judgement, attention to detail, and a continuous improvement mindset.

What you'll do

• Cybersecurity risk and third-party risk management
• Conduct cybersecurity risk assessments for applications, systems, projects, and technology initiatives.
• Perform third-party cybersecurity risk assessments during vendor onboarding, contract reviews, renewals, and ongoing monitoring activities.
• Review vendor security documentation, including SOC 1 and SOC 2 reports, ISO 27001 certifications, penetration test reports, security questionnaires, and other assurance artifacts.
• Identify, document, assess, and communicate cybersecurity risks, control gaps, and remediation recommendations.
• Collaborate with Strategic Procurement, Legal, Privacy, Compliance, and business stakeholders to assess and manage risks associated with third-party relationships.
• Review contracts to support the inclusion of appropriate cybersecurity, privacy, and data protection requirements.
• Monitor remediation activities and follow up with stakeholders to support the timely resolution of identified risks and findings.
• Assist with third-party cybersecurity incident reviews, risk evaluations, and follow-up activities.
• Maintain risk records, assessment results, exceptions, and remediation plans within Governance, Risk and Compliance (GRC) platforms.
• Compliance and control assurance
• Support compliance and control assurance activities related to internal, regulatory, and contractual requirements.

Where this was posted

• LinkedIn

  last seen 1h ago
  View on LinkedIn