IT and Cybersecurity Risk Analyst

Being part of Air Canada is to become part of an iconic Canadian symbol, recently ranked the best Airline in North America. Let your career take flight by joining our diverse and vibrant team at the leading edge of passenger aviation.

The Analyst, IT & Cybersecurity Risk supports Air Canada's cybersecurity risk management and compliance programs. The role helps identify, assess, and manage cybersecurity and technology risks across applications, projects, third-party vendors, and operational processes, while supporting compliance and control assurance activities as required.
The successful candidate will conduct cybersecurity and third-party risk assessments, assist with compliance and control assurance activities and collaborate with business stakeholders to strengthen the organization’s overall security and control environment.

Responsibilities:

Cybersecurity risk and third-party risk management

- Conduct cybersecurity risk assessments for applications, systems, projects, and technology initiatives.
- Perform third-party cybersecurity risk assessments during vendor onboarding, contract reviews, renewals, and ongoing monitoring activities.
- Review vendor security documentation, including SOC 1 and SOC 2 reports, ISO 27001 certifications, penetration test reports, security questionnaires, and other assurance artifacts.
- Identify, document, assess, and communicate cybersecurity risks, control gaps, and remediation recommendations.
- Collaborate with Strategic Procurement, Legal, Privacy, Compliance, and business stakeholders to assess and manage risks associated with third-party relationships.
- Review contracts to support the inclusion of appropriate cybersecurity, privacy, and data protection requirements.
- Monitor remediation activities and follow up with stakeholders to support the timely resolution of identified risks and findings.
- Assist with third-party cybersecurity incident reviews, risk evaluations, and follow-up activities.
- Maintain risk records, assessment results, exceptions, and remediation plans within Governance, Risk and Compliance (GRC) platforms.

Compliance and control assurance

- Support compliance and control assurance activities related to internal, regulatory, and contractual requirements.
- Assist in evaluating and testing IT General Controls (ITGCs) and other technology controls supporting regulatory and compliance obligations.
- Support compliance activities related to PCI DSS, SOC 1, SOC 2, ISO 27001, privacy requirements, and other applicable frameworks.
- Coordinate evidence collection and documentation requests for internal audits, external audits, and compliance reviews.
- Track compliance findings, action plans, remediation activities, and status reporting.
- Assist in maintaining risk registers, compliance dashboards, metrics, and management reporting.
- Identify opportunities to improve control effectiveness, compliance processes, and risk management practices.

Program support and advisory

- Prepare risk summaries, assessment reports, dashboards, and presentations for business and technology stakeholders.
- Support the continuous improvement of cybersecurity risk management and compliance methodologies, processes, templates, and reporting.
- Provide cybersecurity and compliance advisory support to projects, systems, and business initiatives.

Qualifications

- University degree in Information Security, Information Technology, Computer Science, Risk Management, or a related discipline, and/or equivalent practical experience.
- 2 to 4 years of experience in cybersecurity, IT risk management, IT compliance, IT audit, governance, third-party risk management, or a related field.
- Experience conducting cybersecurity risk assessments, control reviews, or compliance activities.
- Understanding of third-party risk management processes and vendor security assessments.
- Experience working with internal controls, IT General Controls (ITGCs), SOC 1, SOC 2, PCI DSS, or ISO 27001.
- Familiarity with cybersecurity and risk frameworks such as NIST, COBIT, SOX, GDPR, and PIPEDA is an asset.
- Familiarity with Governance, Risk and Compliance (GRC) platforms such as Archer, Optro, AuditBoard, MetricStream, or similar tools is an asset.
- Strong analytical, organizational, investigative, and problem-solving skills.
- Strong written and verbal communication skills, with the ability to communicate technical risks and control considerations to business stakeholders.
- Ability to manage multiple priorities and deadlines in a fast-paced environment.
- Collaborative working style, with the ability to build effective relationships across technical and business teams.
- Curiosity, sound judgement, attention to detail, and a continuous improvement mindset.
- Demonstrate punctuality and dependability to support overall team success in a fast-paced environment.

Conditions of Employment:

Candidates must be eligible to work in the country of interest at the time any offer of employment is made and are responsible for obtaining any required work permits, visas, or other authorizations necessary for employment. Prior to their start date, candidates will also need to provide proof of their eligibility to work in the country of interest.

Linguistic Requirements

Based on equal qualifications, preference will be given to bilingual candidates.

Diversity and Inclusion

Air Canada is strongly committed to Diversity and Inclusion and aims to create a healthy, accessible and rewarding work environment which highlights employees’ unique contributions to our company’s success.

As an equal opportunity employer, we welcome applications from all to help us build a diverse workforce which reflects the diversity of our customers, and communities, in which we live and serve.

Air Canada thanks all candidates for their interest; however only those selected to continue in the process will be contacted.