Principal, IT & Cyber GRC

About the role

Questrade Financial Group is seeking a seasoned generalist to lead its IT & Cyber Governance, Risk and Compliance (GRC) function. The Principal will act as a trusted advisor, bridging governance intent with operational execution across IT, cybersecurity, and business teams.

Key responsibilities

• Lead the periodic review and update of technology and cyber governance documentation, ensuring alignment with regulatory changes and industry frameworks.
• Support audit engagements (OSFI, CIRO, SOC 1, SOC 2) and perform quality‑control vetting to maintain an audit‑ready posture.
• Partner with IT and cyber teams to design, review, and validate controls that manage risk without hindering innovation.
• Conduct comprehensive risk assessments for initiatives and entity‑level exposures, and develop remediation roadmaps.
• Provide technical coaching to analysts, curate risk metrics for executive audiences, and champion AI‑driven automation for GRC artifacts.

Required profile

• Minimum 4 + years of IT and cyber risk, audit, or GRC experience within a regulated financial institution.
• Strong academic background in Business, Computer Science, Information Systems, Engineering or equivalent experience.
• Deep knowledge of Canadian regulatory environment (OSFI, CIRO) and global assurance frameworks (SOC 1/2).
• Proven experience developing and maintaining governance policies, standards, and procedures.

Required skills

• NIST CSF, COBIT, ISO 27001, CIS, COSO, ITIL, PCI‑DSS frameworks.
• Regulatory expertise in OSFI, CIRO, SOC 1, SOC 2.
• Advanced prompt engineering for generative AI models to accelerate GRC artifacts.
• Technical knowledge of operating systems and databases.
• Experience with compliance automation tools.

What we offer

• Health and wellbeing resources and programs.
• Paid vacation and personal days for work‑life balance.
• Competitive compensation and benefits packages.
• Career growth and development opportunities.
• Inclusive, collaborative hybrid workplace.