{"id":1510218,"url":"https://alion.io/job/equisoft-security-assurance-and-compliance-specialist","title":"Security Assurance and Compliance Specialist","company":{"id":1945093,"name":"Equisoft","domain":"equisoft.com","url":"https://alion.io/company/equisoft","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Workday","truth_index":null},"role":"Security","role_family":"Security","seniority":"senior","employment_type":"full_time","work_mode":"hybrid","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"explicit","locations":["Montreal, Canada","Quebec, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":63000,"max_usd":117000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":46},"experience_years_min":5,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"Agentic Workflows","optional":false},{"name":"AI Agents","optional":false},{"name":"Azure","optional":false},{"name":"GDPR","optional":false},{"name":"ISO 27001","optional":false},{"name":"ISO 42001","optional":false},{"name":"SentinelOne","optional":false},{"name":"SOC 2","optional":false},{"name":"SQL","optional":false},{"name":"Power Automate","optional":true}],"status":"closed","first_seen_at":"2026-09-18T00:00:00Z","employer_posted_date":"2026-10-16","last_verified_at":"2026-10-24T13:28:11Z","board_verified":false,"closed_at":"2026-10-24T13:28:11Z","days_open":36,"trust":{"level":"not_scored","repost_count":null,"flags":[],"days_open":36},"description":"HYBRID - Québec City, CanadaWhat is Equisoft? Equisoft is a global provider of digital solutions for insurance and investment, recognized by over 250 of the world's leading financial institutions. We offer a comprehensive ecosystem of scalable solutions that help our customers meet all the challenges brought about by this era of digital transformation, thanks to our business needs-driven approach, industry knowledge, cutting-edge technologies and experts. With its business-driven approach, in-depth industry knowledge, cutting-edge technologies and multicultural team of experts based in North America, the Caribbean, Latin America, Europe, Africa, Asia and Australia, Equisoft helps its customers meet the challenges of this era of digital transformation.\nWhy Choose Equisoft? With 950+ employees, we are a stable organization that offers career advancement opportunities and fosters a stimulant environment. If that’s not enough, then check out these other perks below:\nHiring Location: Canada (Montreal)\n\nYou are working hybrid in a collaborative workspace\n\nFull-time Permanent Role\n\nBenefits available day 1: Medical, Dental, Retirement Plan, Telemedicine Program, Employee Assistance Program, etc.\n\nFlexible hours\n\nNumber of hours per week: 40\n\nEducational Support (LinkedIn Learning, LOMA Courses and Equisoft University)\n\nRole: The Specialist, Security Assurance and Compliance reports to the Manager, Information Security and GRC. This role is the operating center of Equisoft’s security governance program. You’ll keep four certifications current (SOC 2 Type II, ISO 27001, ISO 22301, ISO 42001), answer the security questions standing between Equisoft and closed business, and drive recurring control activities - access reviews, patching, vulnerability remediation, pentest follow-up, and awareness training - to completion across teams you don’t manage. This is a coordination, evidence, and automation role, not an engineering one: you define what must happen, track whether it did, produce proof, and automate what shouldn’t require a person. Success is measured by audit outcomes, questionnaire turnaround time, and the percentage of control work running on schedule without escalation.\nWhat You’ll Do:\nGRC: Support the control environment for SOC 2, ISO 27001, ISO 22301, and ISO 42001 - control mapping, evidence collection, auditor liaison. Manage policy lifecycle (review, versioning, publication, attestation). Prepare audit evidence packages and report gaps to closure.\n\nVendor & Third-Party Risk: Own the end-to-end DPIA process (Trust Center/SOC review, DPA/sub-processor analysis, SCC/residency checks, AI assessment, risk rating), vendor intake, the vendor risk register, and fourth-party tracking - chasing missing certs, bridge letters, and remediation commitments.\n\nClient Security Assurance: Complete due diligence questionnaires and RFP security sections within SLA; maintain a response library. Coordinate client audit evidence requests. Issue SOC 2 reports and bridge letters. Serve as security point of contact for Sales, pre-sales, and Legal.\n\nIdentity Governance: Own the quarterly access review (OIPA, Design, SQL, Azure, bastion) - data collection, reviewer follow-up, revocations, closure evidence. Drive access-review automation with the managed services partner.\n\nVulnerability & Pentest Management: Track findings (Tenable, UpGuard, SentinelOne, external ASM), categorize by product/owner, drive remediation tickets and trend reporting. Coordinate the annual pentest (scoping, scheduling, provisioning) and drive findings to closure.\n\nPatch & Configuration Hygiene: Generate monthly patching tickets, confirm completion with infrastructure, and maintain the server software/middleware inventory.\n\nSecurity Awareness: Run the monthly training cycle, produce completion reporting, escalate outstanding completions, and administer the annual training needs survey.\n\nBCDR Support: Supply DR exercise/continuity evidence for client requests; support BIA cycles and tabletop exercises.\n\nReporting & Automation: Produce recurring KPI/leadership reporting. Identify manual control work suitable for automation (asset inventory, ticket creation, evidence extraction, training reporting) and build/commission agentic workflows, with SOPs for each.\n\nRequirements\nTechnical\n5+ years in InfoSec GRC or IT audit in software/regulated services\n\nHands-on ownership of at least one full SOC 2 Type II or ISO 27001 cycle\n\nExperience with B2B client security questionnaires/due diligence\n\nWorking knowledge of GDPR, Quebec Law 25, and PIPEDA\n\nPractical familiarity with vulnerability management/endpoint tooling (Tenable, SentinelOne preferred)\n\nSoft Skills\nFluent in French and English (due to recurrent contact with international teams and customer)\n\nProven ability to drive completion through teams you don’t manage; comfortable escalating slipped commitments\n\nClear, client/auditor-ready writing; strong prioritization under high inbound demand; meticulous attention to detail\n\nNice to Have:\nCISA, CISSP, CRISC, ISO 27001 Lead Implementer/Auditor\n\nISO 42001 or AI management system exposure\n\nInsurance/wealth management industry experience\n\nAgentic/Power Automate automation experience\n\nExperience managing an MSSP\n\nEquisoft is committed to creating a diverse environment and is proud to be an equal opportunity employer. All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status.","description_format":"text","description_chars":5582,"description_truncated":false,"requirements":{"experience_years_min":5,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[{"language":"French","level":"Advanced (C1)","optional":false},{"language":"English","level":"Advanced (C1)","optional":false}]},"benefits":["Retirement plans"],"hiring_locations":[{"name":"Australia","iso":"AU","kind":"country"},{"name":"Canada","iso":"CA","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["Financial Software & Embedded Finance","InsurTech"],"lifecycle":[{"event":"open","at":"2026-09-30T07:41:19Z"},{"event":"close","at":"2026-10-24T13:28:11Z"}],"visa":[],"liveness":null,"pay":null,"html_url":"https://alion.io/job/equisoft-security-assurance-and-compliance-specialist","json_url":"https://alion.io/job/equisoft-security-assurance-and-compliance-specialist.json","meta":{"generated_at":"2026-11-06T05:41:14Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":10000,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1945093},"rest":"https://alion.io/mcp/rest/get_company?id=1945093"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fequisoft-security-assurance-and-compliance-specialist"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fequisoft-security-assurance-and-compliance-specialist"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fequisoft-security-assurance-and-compliance-specialist"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/equisoft-security-assurance-and-compliance-specialist\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fequisoft-security-assurance-and-compliance-specialist"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":1510218}},{"tool":"search_jobs","arguments":{"company":"equisoft.com","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":1510218},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}