Governance, Risk, and Compliance; GRC Specialist

Location:

Fredericton, N.B., (CAN.), Hybrid. In fast changing markets, customers worldwide rely on Thales. Thales is a business where brilliant people from all over the world come together to share ideas and inspire each other. In aerospace, transportation, defence, security and space, our architects design innovative solutions that make our tomorrow's possible.

At Thales, we are proud to work together to imagine innovative solutions that contribute to building a future that is safer, greener and more inclusive. A future that we can all trust. In Canada, Thales is relied on to innovate for customers with high‑stakes goals, critical missions and big ambitions. Our commitment to mastering digital capabilities in Canada strengthens the nation’s economy – through high‑technology jobs, investments in domestic research and technology, and solutions for the aerospace, defence, digital identity and security sectors.

Driven by purpose, values, innovation, and a commitment to building a future we can all trust, Thales Canada seeks to increase digital trust and resilience, offering integrated digital solutions to organizations, mission critical systems and critical infrastructure in both the commercial and the defence community.

• Advisory and Client Engagement:
  Lead discovery sessions, stakeholder interviews, and workshops to understand business context, scope, and compliance objectives. Translate regulatory and framework requirements into actionable program plans, control designs, and implementation roadmaps. Present findings and recommendations to technical and executive audiences; prepare high‑quality client deliverables.
• Framework Readiness and Implementation: CPCSC – Conduct gap assessments, control mapping, and remediation planning against the applicable CPCSC requirements. CMMC (v2) – Perform NIST SP 800‑171/CMMC readiness assessments; develop SSPs and POA&M; define enclaves and scoping; establish evidence collection processes; support clients through RPO/RP‑led journeys. ISO 27001/27002 (2700x family) – Build or mature ISMS programs; conduct risk assessments; develop the Statement of Applicability;
  
  support internal audits and management reviews; prepare for external certification.
• Control Design, Testing, and Continuous Improvement:
  Design and document policies, standards, procedures, and control narratives aligned to applicable frameworks. Build cross‑walks/control catalogs across CPCSC, CMMC, ISO 27001/27002, and related frameworks (e.g., NIST 800‑53). Perform control testing, sampling, and evidence reviews; track remediation and validate closure. Define and operationalize KRIs/KPIs and compliance metrics dashboards.
• Risk Management and Security Governance:
  Facilitate formal risk assessments and treatment plans using recognized methods (ISO 27005, NIST 800‑30, FAIR optional). Advise on secure configurations, IAM, vulnerability and patch management, logging/monitoring, and incident response alignment with compliance needs. Support third‑party/vendor risk assessments and continuous monitoring activities.
• Audit and Certification Support:
  Prepare clients for external audits/assessments; coordinate evidence, walkthroughs, and sampling with assessors/certification bodies. Guide remediation and readiness sprints; develop playbooks for recurring audit cycles.
• Training and Enablement:
  Deliver targeted training and awareness for control owners, process owners, and stakeholders. Create reusable templates, accelerators, and best practices to scale program delivery.

• Bachelor’s degree in Information Security, Information Systems, Computer Science, Risk/Compliance, or related field; or equivalent experience.
• 3–6 years of experience in GRC, cybersecurity compliance, or IT audit, with hands‑on work in at least two of: CMMC/NIST 800‑171, ISO 27001/27002, CPCSC or a similar regional cybersecurity compliance scheme.
• Demonstrated consulting/advisory experience: client‑facing communication, facilitation, slideware, and report writing.
• Practical knowledge of CMMC (v2) practices, NIST SP 800‑171 requirements, SSP/POA&M, scoping/enclave concepts, evidence…