Information Risk Analyst; First Line of Defense; WTL

Position: *Information Risk Analyst (First Line of Defense) (WTL, ON)
Location: Waterloo

Information Risk Analyst (First Line of Defense)
Step into a high-impact, hybrid role at the forefront of cloud security, AI governance, and information risk within the insurance sector. Leverage your expertise in Info Sec, regulatory frameworks, and emerging technologies to shape secure, future-ready solutions. Work cross-functionally in a dynamic, fast-paced environment.
What is in it for you:
• Salaried: $65-70 per hour.

• Incorporated Business Rate: $79-84 per hour.

• 6-month contract with the potential for permanent employment.

• Full-time position: hours per week.

• Weekday schedule from 9 am to 5 pm.

• In-office presence required from Tuesday to Thursday.

• Remote work available on Mondays and Fridays.
Responsibilities:

• Conduct comprehensive assessments of IaaS, PaaS, SaaS, and generative AI projects, identifying and mitigating associated risks.

• Develop and implement governance frameworks tailored to generative AI, aligning with global information risk assessment methodologies.

• Collaborate with cross-functional teams to integrate risk frameworks with processes such as architecture reviews, project risk management, and business continuity.

• Manage task priorities to ensure timely delivery of governance assessments and documentation updates.

• Participate in project meetings to advise stakeholders on risks and potential impacts of proposed changes.

• Ensure peer review of all completed risk assessments prior to stakeholder distribution.

• Support operational security tasks including incident response, firewall reviews, and vulnerability management.

• Provide training on risk assessment procedures and security best practices to internal teams.

• Respond to audits, regulatory reviews, and internal control assessments.

• Stay current on emerging AI technologies, evolving threat landscapes, and developments in AI governance.
What you will need to succeed:
• Degree in Computer Science, Information Technology, Data Science, Business Administration, or a related discipline.

• Relevant professional designations (, CISSP, CRISC, CISM, CISA) are considered an asset.

• 5+ years of experience in information risk management, including vendor risk, project risk, IT audit, or control assessments.

• Background in one or more technical security disciplines, such as network security, application security, identity and access management, cybersecurity, or information protection.

• Strong understanding of cloud computing security in IaaS, PaaS, or SaaS environments.

• Familiarity with laws and standards such as NIST, ISO
27001, GDPR, Sarbanes-Oxley, and the EU AI Act.

• Strong communication and influencing skills to support a culture of governance and risk awareness.

• Effective problem-solving and analytical skills with an innovative mindset.

• Excellent presentation and facilitation skills for technical and non-technical audiences.

• Strong collaboration, time management, and organizational abilities.

• Understanding of the financial services industry and its regulatory landscape is an asset.