Senior GRC Analyst, Quantexa

• 8+ years in information security governance, risk, compliance or security assurance, across global frameworks and regulated government environments
• Experience with government security requirements personnel screening, organizational security, and contractual obligations
• A solid track record running security risk assessments, audits, control testing, and remediation
• A solid working knowledge of ISO/IEC 27001, SOC 2, NIST SP 800-53 (or equivalent) and enterprise/cloud security controls
• Strong communication skills, comfortable engaging senior stakeholders, auditors, and government representatives
• Experience operating within a global security function while owning Government specific requirements
• A strong technical communication ​ability​ with demonstrable experience of working in rapidly changing client environments
• Experience coordinating multiple concurrent compliance initiatives across engineering and business stakeholders
• Experience partnering closely with Privacy and Legal teams on regulatory compliance initiatives
• Experience managing control evidence, remediation programs, and continuous compliance activities
• Strong project management and organizational skills with the ability to manage competing priorities
• Excellent written and verbal communication skills, with the ability to translate complex compliance requirements into practical business guidance

Desirable

• Information Security Governance, Risk and Compliance is a key part of how Quantexa manages security across the organisation
• Our approach focuses on effective security governance, proactive risk management, regulatory and contractual compliance, independent assurance and the continual improvement of our Information Security Management System
• This is a governance focused security role requiring a solid understanding of technical security, cloud environments and modern software development, combined with practical experience across security governance, risk management, compliance and customer assurance
• As part of the role, the successful candidate will serve as Quantexa’s Alternate Company Security Officer (ACSO), supporting our obligations and the current Company Security Officer (CSO) under applicable Canadian Government security requirements
• When appointed this will include responsibilities relating to personnel and organisational security, contractual security requirements, and the protection of Government of Canada information and assets in line with the Contract Security Manual (CSM)
• The role sits within Quantexa’s global Information Security function, headquartered in London, England, and will initially report to the Head of Information Security
• As our Canadian focal point for security governance, the successful candidate will own Canadian Government and customer security requirements while applying Quantexa’s global policies, frameworks and assurance activities
• The successful candidate will also engage with customers, government bodies, security authorities and external assessors, supporting the coordination of security and compliance requirements across our global operations
• Government Experience, Knowledge, and Skills:
• Supporting the Company Security Officer (CSO) and perform responsibilities associated with Quantexa's Alternate Company Security Officer (ACSO) function
• Supporting compliance with applicable government security requirements, including the Public Services and Procurement Canada (PSPC) Contract Security Program and Contract Security Manual
• Managing and own the clearance requests, security briefings, security incidents and debriefings in line with the Contract Security Manual (CSM)
• Reviewing commercial and government contracts, security clauses and procurement documentation to identify applicable requirements, and support their interpretation and implementation
• Information Security Governance, Risk and Compliance:
• Ensuring regulatory, government, contractual and customer security requirements are identified, assessed and appropriately reflected in Quantexa's security controls and governance arrangements
• Monitoring relevant regulatory and government security requirements, assessing their impact on Quantexa and recommending necessary changes
• Maintaining, following and implementing Quantexa's global information security policies, standards and governance requirements within the business
• Supporting continual improvements of Quantexa's security governance framework, incorporating findings from audits, incidents, risk assessments, and evolving regulatory and customer requirements
• Customer, Government and Supplier Assurance:
• Acting as a named security contact for relevant Government departments, customers and security authorities where required
• Supporting customer and government security assurance activities, including due diligence, security assessments, questionnaires and evidence requests
• Supporting third-party and supplier security risk assessments, ensuring identified risks are appropriately documented, escalated and managed
• Maintaining and improving reusable security assurance materials and supporting evidence to promote consistency, reduce duplication and improve response efficiency across customer, partner and government assessments
• Audit, Certification and Control Assurance:
• Supporting internal and external audits, certification activities and ongoing compliance assessments, including ISO/IEC 27001, SOC 2, PCI-DSS, NIST SP 800-53r5, NIST SP 800-218, ISO/IEC 20243 and other applicable assurance frameworks
• Tracking audit findings, control deficiencies and remediation activities, ensuring appropriate ownership, timely resolution and reporting to relevant stakeholders
• Technical Security Governance:
• Working with internal and client technical and operational teams to assess control effectiveness, coordinate testing and obtain appropriate evidence of compliance
• Cross-Functional Partnership:
• Working with Legal and Commercial teams to review contractual information security requirements, assess associated risks and identify obligations requiring further action
• Working with the global information security function to provide clear reporting on security risks, compliance obligations, control effectiveness and remediation progress