{"id":1622727,"url":"https://alion.io/job/paymentscanada-security-compliance-analyst","title":"Security Compliance Analyst","company":{"id":1716135,"name":"Payments Canada","domain":"paymentscanada.ca","url":"https://alion.io/company/paymentscanada","size_band":null,"is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Dayforce","truth_index":null},"role":"Legal","role_family":"Legal","seniority":null,"employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Ottawa, Canada"],"countries":["CA"],"hiring_countries":[],"hiring_countries_total":0,"salary":{"min":83300,"max":null,"currency":"CAD","period":"year","gross":null,"usd_annual":58515},"salary_estimate":null,"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"NIST CSF","optional":false},{"name":"SOC 2","optional":false}],"status":"live","first_seen_at":"2026-08-28T04:00:00Z","employer_posted_date":"2026-10-01","last_verified_at":"2026-10-15T01:44:00Z","board_verified":true,"closed_at":null,"days_open":48,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":48},"description":"| What we are looking for\nReporting to the Manager, Security Compliance, this position carries out the day-to-day work of the Security Compliance function. Working from direction set by the Manager, the incumbent performs control assessments, gathers and documents evidence, keeps compliance trackers and registers current and prepares compliance reporting against internal mandates and external regulations. As a representative of the organization's security function, the incumbent helps promote a culture of security compliance among all employees and works day to day with colleagues across other Payments Canada divisions and with members and user groups as required. \n\nDuties and Responsibilities of the Security Compliance Analyst will include but is not limited to: \nSecurity Compliance\nSupport the development of information security controls by drafting and documenting control statements against existing policies, standards, procedures, regulatory guidelines and security frameworks and routing them to stakeholders for feedback and approval.\nCarry out assessments and validation of security controls across Payments Canada, following the approach and scope set by the Manager, Security Compliance.\nProcess and review Security Exception Requests, checking submissions for completeness, documenting the control gap and any compensating controls, and referring risk acceptance decisions to the Manager, Security Compliance.\nPromote day-to-day compliance with internal policies, standards and procedures, and with external regulatory requirements.\nSupport security related audits (for example, ISO/IEC 27001 and the SWIFT CSP) by gathering evidence, preparing the requested documentation and responding to auditor questions within agreed timelines.\nRespond promptly to routine security compliance questions, and escalate those that call for a decision to the Manager, Security Compliance.\nWork with the other lines of defense= to support improvements in compliance maturity.\nSupport Third-Party Risk Management by reviewing the security clauses, schedules and assurance evidence for third- and fourth-party engagements, working in support of and facilitated through Procurement, Vendor Management and the TPRM function; the vendor relationship and any direct engagement with the vendor are led by those functions. \nPrepare reports and slide decks covering control assessment results, key control indicators and key risk indicators, for the Manager's review ahead of management reporting.\n\nSecurity Governance\nSupport the Technology Governance function on information security policies and standards, checking that they line up with the security control framework and flagging any discrepancies.\nProvide supporting input to the Cyber Resiliency Framework where Security Compliance is asked to contribute, in line with the review cadence.\nFrom a compliance-review perspective, flag opportunities to improve the clarity of security policies and standards and route them to the Technology Governance owner for action.\n\nSecurity Architecture and Support\nTake part in security assessments and reviews for the Security Architecture and Engineering Work Groups, checking new solutions and designs against the applicable security controls.\nApply Secure by Design principles in the reviews completed, so that adequate security controls are considered during the design and architecture phases.\n\nSecurity Information Improvement\nSuggest improvements to internal processes, reporting and documentation that support compliance. \nTrack security assessment findings and improvement actions through to closure, following up with internal stakeholders and escalating delays.\nProvide support in the closure of security related audit findings, engaging with Internal Audit and the control owners to develop and document action plans, and tracking progress.\nOther tasks as assigned by the manager.\n\nTechnical Competencies\nWorking understanding of information security principles, practices, technologies and procedures.\nWorking understanding of information risk management methods and techniques for assessing risks, threats and vulnerabilities.\nAbility to weigh security controls against the risks they address, including the use of compensating controls.\nKnowledge of security control frameworks such as ISO/IEC 27001 and NIST CSF, and how they apply to the security governance and compliance practice.\nAwareness of industry security standards, laws and regulations (for example, ISO/IEC 27001, SWIFT CSP, PIPEDA and Bank of Canada oversight expectations).\nSecurity audit and findings management — tracking findings to closure with documented action plans and evidence, and supporting second- and third-line assessments and internal audits.\nThird-party and vendor risk management (TPRM) fundamentals, including reviewing vendor security assurance evidence and the security clauses and schedules in third-party contracts, in support of and facilitated through Procurement, Vendor Management and the TPRM function.\nSecurity architecture and SDLC compliance gating: assessing projects against the Enterprise Architecture Methodology and Secure by Design principles ahead of go-live.\n\nPersonal Competencies\nEnergetic, self-motivated, quick to learn, and comfortable taking responsibility for assigned work.\nHigh degree of initiative and flexibility.\nStrong communication and organizational skills.\nStrong relationship management skills.\nStrong interpersonal and teamwork skills.\nAbility to work with colleagues in Procurement, Legal, GRC/TPRM, Privacy, TPRM and project teams, explaining security requirements clearly and following up to a workable outcome.\nCare and accuracy in preparing the material that supports responses to regulators (for example, the Bank of Canada), where inquiries and attestations carry firm external deadlines. \nPersistence in carrying contractual security requirements through successive review rounds, with support from the Manager where a position needs to be negotiated.\nAbility to stay organized and composed when demand is deadline-driven and unpredictable, managing a queue of competing commitments.\nStrong attention to detail when documenting exceptions, control gaps and the supporting evidence.\nOwnership of assigned work and the ability to deliver it reliably in a small team, adapting as responsibilities and priorities shift.\nDiscretion and integrity in handling sensitive vendor, audit and regulatory information.\n\n| What you need to be successful\nPost-secondary degree or diploma in computer science or other field related to information systems and technology or information security management or equivalent work experience.\nA minimum of three (3) years of combined relevant work experience in an information security, IT audit or information risk management capacity. Regular activities will have included control assessment, evidence gathering and compliance reporting.\n Sound organizational and time management skills, with the ability to deliver assigned work to agreed timelines.\nAbility to work with stakeholders across teams, take ownership of assigned work and follow it through to completion.\nWorking knowledge of security frameworks such as ISO/IEC 27001, ISO/IEC 27002 and NIST, with general awareness of other industry security frameworks, regulations and standards.\nPractical exposure to cybersecurity compliance, audit support and risk management.\nIndustry certifications, or demonstrated progress towards them, are considered an asset (CISA, CRISC, CISSP, CISM, etc.).\nEligibility to successfully complete background checks that will be carried out by Payments Canada, including criminal, credit, identity, employment, and education checks.\nClear written and verbal communication, with solid report writing skills.\n| You will really stand out with\nThe following are considered an asset, and can be developed in the role:\nThird-party assurance analysis: reviewing SOC 1 and SOC 2 (Type II) reports, exceptions and bridge letters, and validating Complementary User Entity Controls (CUECs) for critical service providers.\nWorking knowledge of the SWIFT Customer Security Programme (CSP) and Customer Security Controls Framework (CSCF) — architecture types, mandatory and advisory controls, independent assessment and annual attestation.\nFamiliarity with financial market infrastructure oversight, including the Bank of Canada's PFMI (Annex F) self-attestation reviews and cyber-resilience expectations for designated systems.\nControl-framework mapping and controls-library maintenance across ISO/IEC 27001, 27002, 27017/27018 (cloud), 27701 (privacy) and 42001 (AI), NIST CSF, CIS, COBIT and SOC 2.\nWorking knowledge of privacy and data-protection obligations (PIPEDA), personal-information handling and cross-border data-flow considerations in vendor\n\n| Salary range\nOur target starting rate for this role is $83,300 with flexibility based on your experience and qualifications. The full salary range and benefits package are detailed below.\nPlease submit your application by September 11, 2026.","description_format":"text","description_chars":9040,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":[],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Information Security","Security Compliance"],"lifecycle":[{"event":"open","at":"2026-10-01T20:52:09Z"}],"visa":[],"liveness":{"score":14,"band":"cold","label":"Long shot","p_open":1,"p_active":0.389,"p_room":0.35,"age_days":48,"expected_fill_days":21,"reasons":["conf:4","win:tail"],"computed_at":"2026-10-15T05:46:00Z"},"pay":{"stated_usd_annual":58515,"is_top_pay":false},"html_url":"https://alion.io/job/paymentscanada-security-compliance-analyst","json_url":"https://alion.io/job/paymentscanada-security-compliance-analyst.json","meta":{"generated_at":"2026-10-15T05:52:28Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":8732,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-16T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":1716135},"rest":"https://alion.io/mcp/rest/get_company?id=1716135"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fpaymentscanada-security-compliance-analyst"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fpaymentscanada-security-compliance-analyst"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fpaymentscanada-security-compliance-analyst"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/paymentscanada-security-compliance-analyst\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fpaymentscanada-security-compliance-analyst"}]}