- Salary
- C$35 – C$45/hr
- Location
- Vancouver, British Columbia
- Type
- Contract
- Department
- Legal
- Experience
- 3+ years
- Closing date
- Today
Description
About the contract role
IT Security Engineer (GRC) on a contract basis to provide maternity leave coverage within the Information Security team. The role will help maintain momentum across core governance, risk and compliance activities, including security policy management, third-party risk assessment, access review coordination, security awareness support and GRC reporting. This is a hands-on individual contributor role suited to someone who can quickly understand established processes, work independently, and provide practical, risk-informed support in a fast-moving, matrixed environment.
Key responsibilities
What this contract offers: an opportunity to contribute to a practical, business-facing GRC programme; work across policy, vendor risk, awareness and reporting; and provide visible support to Information Security leadership during a defined maternity leave coverage period.
IT Security Engineer (GRC) on a contract basis to provide maternity leave coverage within the Information Security team. The role will help maintain momentum across core governance, risk and compliance activities, including security policy management, third-party risk assessment, access review coordination, security awareness support and GRC reporting. This is a hands-on individual contributor role suited to someone who can quickly understand established processes, work independently, and provide practical, risk-informed support in a fast-moving, matrixed environment.
Key responsibilities
- Support the drafting, review, publication and maintenance of security policies, standards and procedures, including updates to the published policy library.
- Conduct and document third-party risk assessments by reviewing vendor security evidence and maintaining accurate TPRA records.
- Coordinate periodic access reviews across identity platforms and support policy acknowledgement tracking.
- Support the design, communication and delivery of security awareness materials, including training content and phishing simulation support.
- Prepare and maintain GRC metrics, dashboards and reporting inputs for leadership review.
- Identify practical opportunities to improve GRC processes, documentation and automation where appropriate.
- Provide practical feedback on GRC tooling, including ServiceNow, Graphite Connect and Microsoft 365, based on day-to-day process and reporting needs.
- Escalate unresolved critical vendor security findings and support risk-based onboarding recommendations.
- Work with Information Security, Risk, Privacy, Training and Internal Communications stakeholders to keep priority GRC deliverables moving during the contract term.
- 3+ years of experience in GRC, IT audit, security compliance or a related information security role.
- Strong policy authoring, communication and technical writing skills.
- Experience reviewing security evidence against established frameworks, standards or certifications such as SOC 2, ISO 27001 or equivalent control frameworks.
- Working knowledge of security principles such as identity and access management, vulnerability management, security operations, encryption and third-party risk.
- Ability to work independently, manage multiple priorities and translate technical risk into clear business-facing recommendations.
- Hands-on experience with any of the following platforms: ServiceNow GRC, Graphite Connect, Confluence, Microsoft 365 or Copilot.
- Experience supporting security awareness, phishing simulations, vendor risk management or access review processes.
- CISA, CRISC, CISM or equivalent certification is an asset.
- Priority policy updates, reviews and publication activities are completed on agreed timelines.
- Vendor security assessments are completed before onboarding decisions, with clear documentation of findings, risks and recommended next steps.
- Access reviews, policy acknowledgements and awareness activities are coordinated, tracked and reported with minimal disruption during the maternity leave period.
- Leadership receives timely, clear and risk-informed GRC reporting inputs.
What this contract offers: an opportunity to contribute to a practical, business-facing GRC programme; work across policy, vendor risk, awareness and reporting; and provide visible support to Information Security leadership during a defined maternity leave coverage period.
Skills
ConfluenceServiceNowSOCRisk ManagementComplianceTechnical WritingSOC 2ISO 27001