Senior Governance, Risk and Compliance Analyst-Cyber Security

• Inspirational,
• innovative and entrepreneurial - this is how we describe our empowered teams.
• Combine your passion with purpose and join a culture that is thriving in the
• face of change.
• National in scope and local in focus, MNP is
• one of Canada’s largest professional service firms providing client-focused
• accounting, consulting, tax, and digital services to clients. Founded in 1958,
• MNP today is a CAD 2 billion+ organization with 10,000+ employees and 150+
• offices across Canada. MNP prides itself on being an ‘advisor’ to its clients
• (individuals, businesses, and organizations), focusing on their success by
• delivering personalized strategies and solutions that help clients reach their
• full potential — wherever business takes them.
• MNP set up MNP Spark, its Global Capability
• Centre (GCC), in Bengaluru in May 2025 with a focus on enabling the Firm drive
• growth, efficiency, customer delight, and innovation, by leveraging high
• quality talent in India. MNP Spark is like any other MNP region/office — front
• facing, client focused but working with all MNP regions in Canada to deliver
• services.
• Make an impact with our Technology - Cyber Security team as
• a Senior Governance, Risk, and Compliance (GRC) Analyst. This diverse team of
• tech-savvy problem solvers enables MNP to take a proactive and prepared
• approach to cyber crime and capitalize on new technologies and innovations. As
• a trusted advisor, you’ll investigate threats, develop policies, and enhance
• infrastructure to minimize the impact of security-related events to protect
• MNP's business operations and reputation.

Responsibilities

• ·Support the development and
• implementation of the cybersecurity risk management program, aligned with the
• Firm’s acceptable risk tolerance.
• ·Develop, maintain, and improve
• cybersecurity policies, standards, procedures, and control requirements;
• coordinate reviews, approvals, communication, and exceptions, and ensure
• stakeholder compliance.
• ·Conduct business impact analyses
• and risk assessments across applications, cloud services, infrastructure,
• vendors, new projects, initiatives, and mergers and acquisitions.
• ·Document findings for risk
• assessment report review and approval; maintain the risk register and track
• findings through treatment, acceptance, and remediation.
• ·Assess control design and
• effectiveness against applicable frameworks and regulatory obligations,
• recommending improvements to security posture; support audits, evidence
• collection, findings management, and issue closure.
• ·Perform third-party security
• assessments of vendor documentation, compliance reports, and contractual
• security obligations; communicate findings to business and procurement
• stakeholders.
• ·Advise technical and business
• stakeholders on day-to-day activities and on cloud, AI, application,
• infrastructure, and third-party risks, translating findings into business
• impact and actionable remediation plans.
• ·Support maturity assessments,
• framework mapping, control rationalization, security awareness, and governance
• improvements.
• ·Define and report KPIs,
• dashboards, and leadership metrics for risk and compliance management,
• cybersecurity training, and awareness.
• Participate in tabletop exercises and disaster
• recovery drills, contributing lessons-learned recommendations; mentor and coach
• junior and intermediate team members

Requirements

Skills and Experience

• ·Experience: 10 to 15 years of IT and cybersecurity
• experience, including at least 5 years in a senior risk management or internal
• audit role.
• ·Governance and compliance: Cybersecurity policy
• management, regulatory assessments, control testing, audit support, evidence
• management, and risk and compliance reporting.
• ·Risk management: Enterprise cybersecurity,
• technology, and cloud risk assessments; business impact assessment, risk
• treatment, registers, and exception management, backed by strong knowledge of
• risk assessment and internal audit frameworks.
• ·Third-party risk: Vendor due diligence, SaaS and
• cloud security reviews, contractual security requirements, and supply-chain
• risk management.
• ·Frameworks and standards: Proven ability to apply
• frameworks and controls such as NIST CSF, CIS Controls, SOC 2, PCI DSS, and
• privacy and data governance frameworks.
• ·Technology knowledge: Cloud security (AWS and
• Azure), identity and access management, security operations, vulnerability
• management, security architecture, data protection and privacy, AI governance
• and security, and application security and secure development practices.
• ·Significant experience in cybersecurity governance,
• risk management, compliance, audit, security consulting, or related
• disciplines.
• ·Practical experience conducting risk assessments
• and control evaluations.
• ·Strong analytical, documentation, organizational,
• written communication, and technical reporting skills.
• ·Ability to communicate with technical and
• non-technical stakeholders and influence decisions through collaboration,
• evidence, and sound risk management.
• ·Experience working with global stakeholders across
• India and Canada time zones, ideally in a professional services or regulated
• environment.
• ·Experience managing multiple assessments and
• competing priorities.

Educational

• ·Bachelor’s degree in cybersecurity, information
• technology, risk, audit, or related discipline, or equivalent practical
• experience.

Certifications

• ·CISM, CISSP, CRISC, CISA, or other relevant
• security certifications are considered an asset. Equivalent experience and
• demonstrated expertise are also highly valued.

Benefits

MNP is proud to offer customized rewards that support our unique culture and a balanced lifestyle to thrive at work and outside of the office. Team members have access to learning and development opportunities, a collaborative work environment, firm-sponsored events, and programs that support professional growth.