Contribute to operational risk management and incident response for the CGI Payroll Services Centre (PSC), a Payment Service Provider (PSP) registered with the Bank of Canada under the Retail Payment Activities Act (RPAA), its regulations, and applicable supervisory guidelines.

The PSC processes payroll for more than 70,000 clients through the Nethris and Employer D brands. As such, it is subject to the Bank of Canada’s retail payments supervision framework and must maintain an operational risk management and incident response framework that meets the expectations set out in the Operational Risk and Incident Response supervisory guideline. You will join the team responsible for building and operating this framework.

Your future duties and responsibilities

Risk Identification and Assessment

- Conduct Risk and Control Self-Assessments (RCSA), including the inventory of processes, assets, systems, and third parties; determination of inherent risk exposure; assessment of control effectiveness; and determination of residual risk.
- Participate in defining risk identification and assessment methodologies, rating scales, and enterprise-wide tools.
- Recommend risk treatment measures and monitor them through to closure.
- Contribute to scenario analysis and risk assessments for projects and significant changes.

Incident Response and Regulatory Reporting
- Support the management of operational incidents, including assessing material impacts, escalation, and notification to the Bank of Canada and affected parties within prescribed timelines (48 hours).
- Contribute to testing incident response, business continuity, and recovery plans.
- Monitor operational losses and contribute to root cause analysis.

Monitoring and Reporting
- Collect inputs and produce Key Risk Indicators (KRIs) and reliability targets.
- Support operational risk reporting, including the annual report to the Bank of Canada, incident reports, project risk assessments, and management dashboards.
- Ensure comprehensive coverage of processes through governance documentation, including policies, procedures, and methodologies, and ensure alignment with the requirements of the RPAA and its regulations.





Stakeholder Support
- Provide objective review and challenge of risk assessments performed by the first line of defence.
- Support IT, Operations, Compliance, and Legal teams in drafting procedures and identifying risks and mitigation measures.
- Communicate complex analyses clearly to non-specialist audiences, including senior management.

Required qualifications to be successful in this role

- Relevant experience in operational risk management or non-financial risk management, ideally within a financial institution, payment services organization, or fintech.
- Hands-on experience with RCSA processes, risk indicators, operational loss tracking, and incident management.
- Knowledge of at least one recognized risk management framework, such as COSO ERM, ISO 31000, NIST CSF, or equivalent.
- Knowledge of the RPAA, the Bank of Canada’s supervisory framework, or a comparable regulatory framework, such as OSFI Guideline E-21 on Operational Risk Management and Resilience, B-10 on Third-Party Risk Management, or B-13 on Technology and Cyber Risk Management, is a strong asset.
- Critical thinking and professional judgment in ambiguous situations, with the ability to prioritize based on risk level and impact.
- Ability to prepare clear, structured, and well-documented reports.
- Advanced bilingual proficiency in French and English, both written and spoken, is required.
- Qualified designations such as CRMA, PRM, CRM, FRM, CIA, CISA, or CRISC are considered assets.
- Openness to emerging technologies, particularly artificial intelligence, and a willingness to act as an ambassador for their adoption.

GI is providing a reasonable estimate of the pay range for this role. The determination of this range includes factors such as skill set level, geographic market, experience and training,



and licenses and certifications. Compensation decisions depend on the facts and circumstances of each case. A reasonable estimate of the current range is $50,000–$100,000. This role is an existing vacancy. Together, as owners, let’s turn meaningful insights into action.

Life at CGI is rooted in ownership, teamwork, respect and belonging. Here, you’ll reach your full potential because…

You are invited to be an owner from day 1 as we work together to bring our Dream to life. That’s why we call ourselves CGI Partners rather than employees. We benefit from our collective success and actively shape our company’s strategy and direction.

Your work creates value. You’ll develop innovative solutions and build relationships with teammates and clients while accessing global capabilities to scale your ideas, embrace new opportunities, and benefit from expansive industry and technology expertise.

You’ll shape your career by joining a company built to grow and last. You’ll be supported by leaders who care about your health and well-being and provide you with opportunities to deepen your skills and broaden your horizons.

At CGI, we value the strength that diversity brings and are committed to fostering a workplace where everyone belongs. We collaborate with our clients to build more inclusive communities and empower all CGI partners to thrive. As an equal-opportunity employer, being able to perform your best during the recruitment process is important to us. If you require an accommodation, please inform your recruiter.

That same commitment to fairness extends to how we use technology. To support our recruitment team, AI tools may be used to help assess applications though they never replace human judgement. All hiring decisions remain entirely in the hands of our recruitment professionals.

To learn more about accessibility at CGI, contact us via email. Please note that this email is strictly for accessibility requests and cannot be used for application status inquiries.

Come join our team—one of the largest IT and business consulting services firms in the world.

📌 Risk Analyst (Montreal)
🏢 CGI
📍 Montreal