InfoSec Compliance Analyst

We are seeking an InfoSec Certification and Compliance Analyst to join our InfoSec team. In this role, you will help on various certification projects. You will review certification requirements, map the requirements to security controls, perform gap analysis, and work with internal teams to remediate risks and close the security gaps. You will work with team members to ensure the Information Security Management System (ISMS) adherence to industry standards, laws, best practices, and various certification requirements. Additionally, you will help to support company-wide compliance and regularity requirements, maintain and improve the ISMS to uphold the confidentiality, integrity, and availability of sensitive information.

Responsibilities :

• Work with team members to achieve and maintain compliance with ISO 27K, SOC2, NIST, SCRM, GDPR, and other security standards and regulatory frameworks.
• Review various security certification and compliance requirements, perform requirement mapping, and prepare gap analysis report.
• Develop action plans and follow up with internal teams to close the security control gaps.
• Contribute to the continuous improvement of the ISMS in accordance with ISO 27001 and NIST SP800-53 Standards.
• Develop IT policies, procedures and guidelines, and provide improvement recommendations to current ones.
• Conduct risk assessment to information systems and business processes.
• Collaborate with operation teams to ensure that appropriate controls are implemented, operating properly, in accordance with the corporate policies and compliance requirements.
• Conduct audit readiness assessments and coordinate with internal and external functions and audit resources.
• Develop, collect and analyze security metrics to determine compliance and risk levels, as well as trends in systems and processes, and make recommendations on improvements and decisions based on information from the metrics.
• Work closely with Corporate Information Security Team and other business units as required to understand IS-related challenges and develop plans aimed at addressing these challenges.
• Respond to request for information on security compliance from customers and partners.

Qualifications and Experience :

• Bachelor degree in Information Security, Cybersecurity, Information Technology, or a related field
• 3+ years of hands-on experience in information security, audit, compliance, risk management, or a related field.
• Extensive expertise in managing compliance frameworks such as ISO 27001, SOC2, NIST, SCRM, and GDPR.
• Proven track record in designing and implementing information security policies, procedures, and controls.
• Experience with key security technologies including Security Information and Event Management (SIEM) systems, firewalls, network and host intrusion prevention and detection systems, proxies, vulnerability scanners, and endpoint protection solutions.
• Experience or deep knowledge in cloud security, including cloud-specific security frameworks such as the Cloud Security Alliance's (CSA) Cloud Controls Matrix (CCM), FedRAMP and ISO / IEC 27017, 27018.
• Demonstrated ability to comprehend and interpret audit and security requirements effectively.
• One or more of the following certifications preferred : ISO 27001 LA, CISA, CISM, CISSP and CCSP; The ISO 27001 LA and CISA certifications are highly desirable.
• Proficient in Microsoft Office applications (Word, Excel, and PowerPoint), collaboration platforms (SharePoint, Outlook, and Teams), and GRC / Compliance Management tools.
• Soft Skills : Exceptional interpersonal and communication abilities; meticulous attention to detail and accuracy; strong organizational and project management acumen.

Additional Mandatory Requirements :

• This position requires a hybrid work model, with employees expected to work on-site at our Burnaby office for a minimum of three days per week.