Cybersecurity Specialist

Kraken Robotics Inc.•Mount Pearl, NL

52d•Remote

About The Position

Kraken Robotics is recruiting a Cybersecurity Specialist to operate and enforce day-to-day information security controls across corporate, cloud, and SaaS environments. The role supports the company’s ISO/IEC 27001 Information Security Management System (ISMS) and SOC 2 Type II compliance, including control monitoring, evidence management, risk-register updates, remediation, and audit activities. The position also administers the Vanta GRC platform, supports access control and incident response, validates operational security controls, and contributes to security infrastructure, vendor risk management, user guidance, and continuous improvement. The specialist will help deliver the security awareness and phishing resistance program using KnowBe4. The position can be remote anywhere in Canada or the US, with preference for candidates located in cities where Kraken has offices.

Requirements

Post-secondary education in Cybersecurity, Information Technology, Computer Science, or a related field, or equivalent practical experience.
Experience supporting operational cybersecurity, information security programs, or compliance initiatives.
Working knowledge of ISO/IEC 27001, SOC 2 Trust Services Criteria, and common operational security controls.
Experience collecting, maintaining, and validating audit-ready security evidence.
Technical security knowledge in areas such as identity and access management, endpoint security, logging and monitoring, vulnerability management, and secure system configuration.
Strong written and verbal communication skills, including the ability to explain security requirements to technical and non-technical audiences.
High attention to detail and a disciplined, evidence-driven approach to security operations.
Ability to translate security requirements into practical, enforceable operational controls.
Strong organizational and time-management skills in a multi-priority environment.
Self-motivation, a proactive mindset, and commitment to continuous improvement.

Nice To Haves

Experience working with GRC platforms such as Vanta or similar.
Experience operating in regulated, customer-assessed, or compliance-driven environments.
Relevant certifications such as Security+, SSCP, CISSP, or ISO 27001 Lead Implementer/Auditor.

Responsibilities

Operate and enforce day-to-day information security controls across corporate, cloud, and SaaS environments.
Support the ISO/IEC 27001 ISMS by monitoring control operation, maintaining evidence, addressing control gaps, and updating the risk register.
Support SOC 2 Type II compliance by ensuring security and availability controls operate effectively and are supported by accurate, auditable evidence.
Administer and maintain the Vanta GRC platform for control tracking, evidence collection, remediation management, and audit activities.
Enforce access control processes, including onboarding and offboarding, privileged access reviews, and periodic access recertification.
Monitor and respond to security alerts and incidents in coordination with managed detection and response and SOC providers.
Support incident response investigations, documentation, corrective actions, and post-incident reviews.
Validate operational controls for logging, monitoring, vulnerability management, backup verification, and configuration compliance.
Support cybersecurity infrastructure and policy projects, including implementation and rollout of security tools, platforms, and control capabilities.
Enforce secure system usage and data handling requirements, escalating non-compliance and control failures as appropriate.
Support third-party security and vendor risk management, including review of ISO 27001 certifications, SOC 2 reports, and related assurance artifacts.
Identify gaps between documented controls and operational practice and work with internal teams on remediation and continuous improvement.
Guide users on secure system usage and data handling requirements in line with company policy.
Support the security awareness and phishing resistance program using KnowBe4, including training campaign administration, simulated phishing exercises, post-email analysis workflows, user remediation, and reporting.