Security GRC Analyst, Mergers & Acquisitions

Accountabilities:

Lead security governance, risk, and compliance activities across newly acquired companies, ensuring their control environments are progressively integrated into the organization's enterprise security framework.
Conduct security assessments during the acquisition due diligence process, where timelines allow, or immediately following transaction completion.
Evaluate each acquired company's security posture, including its control environment, identity and access management, infrastructure, third-party dependencies, and previous audit or regulatory examination history.
Prepare comprehensive security assessments against established security baselines, distinguishing between risks that may affect the transaction and those requiring long-term operational remediation.
Collaborate with M&A Technology teams and deal stakeholders to communicate security findings, identify integration requirements, and estimate the resources needed to address control deficiencies.
Map existing controls within acquired entities to internal security frameworks and applicable external standards, identifying gaps, overlaps, and opportunities for alignment.
Determine which existing organizational policies and controls can be extended to acquired entities, which require specific adaptations, and where new policies or controls must be introduced.
Assess control maturity at the entity level, document supporting evidence, and establish realistic remediation plans based on the acquired organization's size, capabilities, and current maturity.
Define measurable remediation milestones, including clear deadlines, accountable owners, and expected risk reduction outcomes.
Prioritize remediation activities according to risk severity and potential business impact rather than simply following framework requirements or addressing the easiest gaps first.
Monitor remediation progress, maintain regular follow-up with control owners, and escalate overdue activities or significant risks to Security GRC leadership.
Prepare proposed risk acceptance decisions, documenting their rationale and compensating controls for leadership review and approval.
Maintain acquired-entity risks within the enterprise risk register and ensure accurate, up-to-date reporting.
Prepare acquired companies for inclusion in external audit scopes by coordinating evidence collection, documentation, and audit walkthrough support.
Serve as the primary Security GRC contact for acquired-company leadership, finance teams, internal auditors, and other relevant stakeholders.
Develop and maintain entity-specific policy libraries where existing corporate policies do not adequately address local requirements or operational circumstances.
Coordinate the integration of third-party providers and vendors into established security governance and compliance processes.
Manage the transition of acquired entities to centralized GRC coverage once their control maturity reaches the required level, ensuring all handover activities are properly documented.
Develop standardized onboarding procedures and reusable documentation to make the acquisition integration process repeatable and scalable.
Identify recurring security and compliance findings and incorporate lessons learned into future acquisition due diligence activities.
Requirements:
At least 5–7 years of professional experience in security governance, IT risk management, or regulatory compliance, preferably within regulated financial services, fintech, or virtual asset environments.
Direct experience integrating an acquired company into an existing security controls, governance, or compliance program. This is a core requirement for the position.
Working knowledge of SOX and Internal Control over Financial Reporting (ICFR) IT General Controls (ITGCs), including an understanding of external audit evidence requirements.
Practical experience with at least two of the following security and compliance frameworks: ISO 27001, SOC 1, SOC 2, and PCI DSS.
Strong understanding of control mapping across multiple regulatory and security frameworks, including the ability to identify gaps and establish appropriate control alignment.
Demonstrated ability to evaluate security control maturity and develop realistic remediation roadmaps that organizations can successfully implement, including teams operating below the required maturity level.
Hands-on experience managing security assessments independently, including defining assessment scope, gathering and reviewing evidence, documenting findings, and driving remediation activities through completion.
Strong analytical and risk assessment capabilities, with sound judgment when prioritizing issues and making recommendations based on incomplete or evolving information.
Ability to recognize situations requiring leadership decisions and escalate significant risks with clear supporting analysis and recommendations.
Experience building effective working relationships with technical control owners across identity and access management, infrastructure, engineering, and other security-related functions.
Excellent communication skills, with the ability to translate technical control deficiencies into clear business risks and actionable recommendations for executives and M&A stakeholders.
Strong project management and organizational skills, particularly when coordinating complex initiatives across cross-functional and geographically distributed teams.
Ability to work independently, take ownership of an emerging program, and establish structured processes in an environment where existing procedures may be limited.
Relevant professional certifications such as CISA, CRISC, CISM, CISSP, or ISO 27001 Lead Implementer are considered an advantage.
Previous experience in mergers and acquisitions, post-merger integration, or technology integration projects is highly desirable.
Familiarity with PKM is an additional advantage.
Benefits:
Fully remote working arrangement, with the flexibility to work from Canada.
Opportunity to own and develop a specialized Security GRC domain with significant autonomy and responsibility.
Direct involvement in mergers and acquisitions, from initial due diligence through post-acquisition integration and ongoing compliance management.
High visibility and regular collaboration with executive leadership, deal teams, acquired-company management, and external auditors.
Opportunity to build and implement scalable security governance and risk management processes from the ground up.
Exposure to complex international regulatory environments and diverse financial technology businesses.
Opportunity to contribute to enterprise-wide security controls supporting future public company reporting and external audit requirements.
Significant potential for professional growth as the acquisition pipeline expands across multiple jurisdictions and regulatory frameworks.
Collaboration with an international, remote-first team of security and technology professionals.
Opportunity to influence strategic decisions and directly strengthen the organization's security and compliance maturity.