Senior Cybersecurity GRC Analyst
About The Position
CareRx is looking for an experienced Senior Cybersecurity Governance & Compliance Analyst for a 3-month contract, reporting to the Director, Cybersecurity, to join our team in a highly regulated healthcare environment where protecting sensitive patient and prescription data is critical to our mission. As a senior member of the Cybersecurity team, you will support CareRx's cybersecurity governance program through PCI DSS readiness, enterprise risk management, policy development, and compliance initiatives that strengthen the organization's overall cybersecurity posture. Working closely with business and technology stakeholders, you will help mature CareRx's governance and compliance capabilities. You should be able to work in a fast-paced and collaborative environment, with the ability to be nimble, multi-task, and problem solve. You take initiative, excel at strategic planning, and can handle multiple initiatives in parallel. The role is expected to grow in scope and responsibility as the cybersecurity program continues to mature, with measurable impact across risk reduction, detection quality, and incident readiness.
Requirements
- 5+ years of professional experience in cybersecurity governance, risk management, cybersecurity compliance, PCI Readiness or a related cybersecurity discipline.
- Demonstrated experience supporting PCI DSS assessments, gap analyses, remediation planning, control assessments, or readiness initiatives.
- Experience assessing business processes, documenting workflows, identifying control gaps, and developing remediation recommendations.
- Experience working with cross-functional stakeholders to document, propose solutions to and address control and compliance gaps.
- Experience conducting cybersecurity risk assessments and developing and maintaining enterprise cybersecurity risk registers.
- Strong understanding of cybersecurity governance frameworks, including the NIST Cybersecurity Framework (CSF), ISO/IEC 27001, CIS Critical Security Controls (CIS Controls), and COBIT.
- Experience developing cybersecurity policies, standards, procedures, and governance documentation.
- Experience using Governance, Risk, and Compliance (GRC) platforms.
- Strong analytical and problem-solving skills with the ability to assess risk, prioritize remediation activities, and communicate recommendations effectively.
- Excellent written, presentation, and verbal communication skills with the ability to communicate effectively with technical and non-technical stakeholders.
Nice To Haves
- Experience within healthcare, pharmacy, or another regulated industry.
- Knowledge of Canadian privacy legislation, including PIPEDA, and experience supporting regulatory compliance programs.
- Relevant security certifications such as PCIP, CISSP, CISM, GRISC, CGRC, and ISO/IEC 27001
Responsibilities
- Lead activities supporting CareRx's PCI DSS readiness program by assessing business processes, documenting control gaps, and developing risk-based remediation recommendations.
- Assess payment workflows, security controls, supporting documentation, and operational processes to identify PCI DSS compliance gaps and opportunities for improvement.
- Partner with business and technology stakeholders to document current-state processes, validate requirements, and support PCI DSS readiness initiatives.
- Develop executive and business level reports on remediation recommendations to support PCI DSS readiness initiatives.
- Develop practical, risk-based remediation recommendations and work with stakeholders to prioritize activities that improve PCI DSS readiness and overall cybersecurity maturity.
- Monitor remediation initiatives and provide regular reporting on compliance progress, cybersecurity risks, and outstanding actions.
- Develop, maintain, and continuously improve the enterprise cybersecurity risk register by identifying, documenting, assessing, and tracking cybersecurity risks.
- Conduct cybersecurity risk assessments and collaborate with stakeholders to evaluate organizational risk and recommend practical mitigation strategies.
- Develop and maintain cybersecurity policies, standards, procedures, and governance documentation aligned with industry best practices and regulatory requirements.
- Monitor compliance with cybersecurity policies, standards, and applicable regulatory requirements.
- Support internal and external compliance activities through evidence collection, documentation, control validation, and remediation tracking.
- Support third-party risk management activities, including vendor security assessments, security due diligence, and remediation tracking.
- Develop governance metrics, Key Performance Indicators (KPIs), and Key Risk Indicators (KRIs) to measure program effectiveness and support executive reporting.
- Participate in cybersecurity assessments, governance reviews, and continuous improvement initiatives.
- Stay current on emerging cybersecurity threats, governance frameworks, regulatory requirements, and industry best practices.
- Perform other related duties as assigned.
Benefits
- flexible medical and dental coverage
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Senior
Education Level
No Education Listed
