Security Compliance Analyst

Take part in security assessments and reviews for the Security Architecture and Engineering Work Groups, checking new solutions and designs against the applicable security controls.

Apply Secure by Design principles in the reviews completed, so that adequate security controls are considered during the design and architecture phases.

Suggest improvements to internal processes, reporting and documentation that support compliance.

Track security assessment findings and improvement actions through to closure, following up with internal stakeholders and escalating delays.

Provide support in the closure of security related audit findings, engaging with Internal Audit and the control owners to develop and document action plans, and tracking progress.

Other tasks as assigned by the manager.

Working understanding of information security principles, practices, technologies and procedures.

Working understanding of information risk management methods and techniques for assessing risks, threats and vulnerabilities.

Ability to weigh security controls against the risks they address, including the use of compensating controls.

Knowledge of security control frameworks such as ISO/IEC 27001 and NIST CSF, and how they apply to the security governance and compliance practice.

Awareness of industry security standards, laws and regulations (for example, ISO/IEC 27001, SWIFT CSP, PIPEDA and Bank of Canada oversight expectations) .

Security audit and findings management — tracking findings to closure with documented action plans and evidence, and supporting second- and third-line assessments and internal audits.

Third-party and vendor risk management (TPRM) fundamentals, including reviewing vendor security assurance evidence and the security clauses and schedules in third-party contracts, in support of and facilitated through Procurement, Vendor Management and the TPRM function.

Security architecture and SDLC compliance gating: assessing projects against the Enterprise Architecture Methodology and Secure by Design principles ahead of go-live.

Energetic, self-motivated, quick to learn, and comfortable taking responsibility for assigned work.

High degree of initiative and flexibility.

Strong communication and organizational skills.

Strong relationship management skills.

Strong interpersonal and teamwork skills.

Ability to work with colleagues in Procurement, Legal, GRC/TPRM, Privacy, TPRM and project teams, explaining security requirements clearly and following up to a workable outcome.

Care and accuracy in preparing the material that supports responses to regulators (for example, the Bank of Canada), where inquiries and attestations carry firm external deadlines.

Persistence in carrying contractual security requirements through successive review rounds, with support from the Manager where a position needs to be negotiated.

Ability to stay organized and composed when demand is deadline-driven and unpredictable, managing a queue of competing commitments.

Strong attention to detail when documenting exceptions, control gaps and the supporting evidence.

Ownership of assigned work and the ability to deliver it reliably in a small team, adapting as responsibilities and priorities shift.

Discretion and integrity in handling sensitive vendor, audit and regulatory information.

| What you need to be successful

Post-secondary degree or diploma in computer science or other field related to information systems and technology or information security management or equivalent work experience.

A minimum of three (3) years of combined relevant work experience in an information security, IT audit or information risk management capacity. Regular activities will have included control assessment, evidence gathering and compliance reporting.

Sound organizational and time management skills, with the ability to deliver assigned work to agreed timelines.

Ability to work with stakeholders across teams, take ownership of assigned work and follow it through to completion.

Working knowledge of security frameworks such as ISO/IEC 27001, ISO/IEC 27002 and NIST, with general awareness of other industry security frameworks, regulations and standards.

Practical exposure to cybersecurity compliance, audit support and risk management.

Industry certifications, or demonstrated progress towards them, are considered an asset (CISA, CRISC, CISSP, CISM, etc.).

Eligibility to successfully complete background checks that will be carried out by Payments Canada, including criminal, credit, identity, employment, and education checks.

Clear written and verbal communication, with solid report writing skills.

| You will really stand out with

The following are considered an asset, and can be developed in the role:

Third-party assurance analysis: reviewing SOC 1 and SOC 2 (Type II) reports, exceptions and bridge letters, and validating Complementary User Entity Controls (CUECs) for critical service providers.

Working knowledge of the SWIFT Customer Security Programme (CSP) and Customer Security Controls Framework (CSCF) — architecture types, mandatory and advisory controls, independent assessment and annual attestation.

Familiarity with financial market infrastructure oversight, including the Bank of Canada's PFMI (Annex F) self-attestation reviews and cyber-resilience expectations for designated systems.

Control-framework mapping and controls-library maintenance across ISO/IEC 27001, 27002, 27017/27018 (cloud), 27701 (privacy) and 42001 (AI), NIST CSF, CIS, COBIT and SOC 2.

Working knowledge of privacy and data-protection obligations (PIPEDA), personal-information handling and cross-border data-flow considerations in vendor

| Salary range

Our target starting rate for this role is $83,300 with flexibility based on your experience and qualifications. The full salary range and benefits package are detailed below.

Please submit your application by September 11, 2026.

| What's in it for you?

Flexible, hybrid (remote/office) environment.

Competitive compensation package, including annual variable bonus and defined contribution pension plan with employer matching percentage (if eligible).

Comprehensive health and dental benefit coverage, including mental health coverage, life insurance and a health spending account for you and your dependents (Permanent and temporary employees with contracts 12 months and over).

Paid time off: minimum four weeks paid vacation, sick and personal days, December holiday shutdown and cultural holiday observance days.

26 weeks of paid maternity and parental leave top-up (if eligible)

Rewards and recognition program.

Access to office gym facilities.

Internal and external professional development opportunities.

Fun team and organizational events.

Monthly all staff forums led by our Executive Leadership Team .

| Our Commitment to Fair Hiring

At Payments Canada, we are dedicated to fair, transparent and inclusive hiring. We are an equal opportunity employer and value diversity at our company. Our recruitment process uses automated tools, but not generative AI, to objectively screen and evaluate applications and confirm that a candidate’s qualifications meet job requirements.

It is important to remember that these tools support, but do not replace, human decision-making. Our trained recruitment professionals and hiring managers always make the final hiring decisions.

| Our diversity, inclusion and equity commitment

At Payments Canada, we are committed to making everyone feel they can be themselves and thrive at work. We will continue to build on a foundation of respect and appreciation for diversity in all forms and collectively create an inclusive and equitable culture where our differences are valued.

We are committed to employment equity and actively encourage applications from women, Aboriginal people, persons with disabilities and visible minorities. If selected for an interview, please advise us if you require special accommodation by emailing hrinfo@payments.ca .

We thank all applicants for their interest in this opportunity. Preference will be given to Canadian citizens and permanent residents. Only selected candidates will be contacted for an interview.