SPECIALIST, IT RISK MANAGEMENT - Montreal, Toronto, Calgary and Vancouver

POSITION OVERVIEW

As part of the Operational Risk Management (ORM) team, you will help strengthen the organization's ability to identify, assess, monitor, and manage Information Security (InfoSec) and Information Technology (IT) risks. You will act as a subject matter expert in operational risk and technology risk management, providing oversight, challenge, and guidance to stakeholders across the organization. Your work will contribute directly to the effectiveness and evolution of BDC’s operational risk framework while supporting strategic and digital transformation initiatives.

CHALLENGES TO BE MET

• Support first- and second-line stakeholders in the execution of Operational Risk Management programs, including: Risk and Control Self-Assessments (RCSA); Key Risk Indicators (KRI); Operational Risk Events; Business Continuity Management (BCM); Risk Appetite activities; New product, project, and business initiative risk assessments.
• Review and challenge Information Security and Technology risk assessments completed by the first line of defence.
• Review and challenge operational risk events related to Information Security and Technology.
• Monitor remediation activities and action plans to ensure risks are addressed effectively.
• Recommend enhancements to technology risk assessment methodologies, processes, and tools.
• Support the continuous improvement of ORM practices to align with operational realities and industry best practices.
• Manage ORM reporting activities, including: Data collection and analysis; Risk reporting; Action plan tracking; Committee and governance presentations.
• Develop and maintain relationships with key stakeholders, including first-line leadership, second-line risk functions, and senior management.
• Develop, maintain, and enhance ORM governance documents, procedures, and methodologies.
• Coach and mentor junior team members to strengthen overall ORM capabilities.
• Contribute to initiatives that support BDC’s mission of helping Canadian entrepreneurs succeed while maintaining sound risk management practices.

WHAT WE ARE LOOKING FOR

Required Qualifications

• Bachelor’s degree in Information Technology, Communications, Business Administration, Social Sciences, or a related discipline.
• Minimum five (5) years of experience in one or more of the following areas: Technology Risk Management; Technology Resilience; Technology Audit; Information Security Risk Management; Related risk management disciplines.
• Demonstrated expertise in at least one of the following domains: IT Operations; Information Security (InfoSec); Data Risk Management; Digital Technology Risk; Emerging Technology Risk.
• Knowledge of governance, risk, and control frameworks, including the Three Lines of Defence model.
• Experience reviewing, assessing, and challenging technology and information security risks.
• Experience monitoring remediation plans, corrective actions, and risk mitigation activities.
• Ability to analyze complex business requirements and translate them into risk management considerations.
• Strong analytical and quantitative skills.
• Advanced Microsoft Excel skills.
• Excellent written and verbal communication skills in both French and English.
• Experience preparing and delivering presentations to stakeholders and senior leaders.
• Ability to work effectively with senior stakeholders and provide credible challenge when required.
• Ability to manage multiple priorities and work in a fast-paced environment.
• Strong planning, coordination, organization, implementation, and training skills.
• Demonstrated judgment in identifying, escalating, and mitigating risks that may impact business operations.
• Ability to meet deadlines and work effectively in a multicultural and bilingual environment.
• Proficiency with: Microsoft Word; Microsoft PowerPoint; Microsoft Visio; Microsoft Office Suite.
• Ability to build trusted relationships with internal stakeholders.
• Ability to clearly explain risk management initiatives and gain stakeholder engagement.
• Demonstrated ability to leverage AI tools to improve efficiency and enhance the quality of work products.

Preferred Qualifications

• Master’s degree or equivalent combination of advanced education and relevant experience.
• Professional certifications in Risk, Governance, Audit, or Information Security, such as: CRISC (Certified in Risk and Information Systems Control); CISM (Certified Information Security Manager); CISA (Certified Information Systems Auditor); CISSP (Certified Information Systems Security Professional); COBIT; Open FAIR™.
• Experience in the banking, financial services, or regulated industry sector.
• Experience with Power BI reporting, analytics, and dashboard development.
• Experience supporting digital transformation, technology modernization, or enterprise risk initiatives.
• Continuous improvement mindset with demonstrated experience enhancing risk management processes and methodologies.

#INDHP