Full time Permanent Role Flexible hours Educational Support (LinkedIn Learning, LOMA Courses and Equisoft University) Role: The Specialist, Security Assurance and Compliance reports to the Manager, Information Security and GRC. This role is the operating centre of Equisoft’s security governance program. You’ll keep four certifications current (SOC 2 Type II, ISO 27001, ISO 22301, ISO 42001), answer the security questions standing between Equisoft and closed business, and drive recurring control activities — access reviews, patching, vulnerability remediation, pentest follow‑up, and awareness training — to completion across teams you don’t manage.

This is a coordination, evidence, and automation role, not an engineering one: you define what must happen, track whether it did, produce proof, and automate what shouldn’t require a person. Success is measured by audit outcomes, questionnaire turnaround time, and the percentage of control work running on schedule without escalation. Equisoft is a stable organization offering career advancement opportunities and fostering a stimulant environment with 950+ employees.

Medical Dental Retirement Plan Employee Assistance

Program GRC: Support the control environment for SOC 2, ISO 27001, ISO 22301, and ISO 42001 — control mapping, evidence collection, auditor liaison. Manage policy lifecycle (review, versioning, publication, attestation). Vendor & Third-Party Risk: Own the end-to-end DPIA process (Trust Center/SOC review, DPA/sub‑processor analysis, SCC/residency checks, AI assessment, risk rating), vendor intake, the vendor risk register, and fourth‑party tracking — chasing missing certs, bridge letters, and remediation commitments.

Client Security Assurance: Complete due diligence questionnaires and RFP security sections within SLA; Serve as security point of contact for Sales, pre‑sales, and Legal.

Identity Governance: Own the quarterly access review (OIPA,



Design, SQL, Azure, bastion) — data collection, reviewer follow‑up, revocations, closure evidence.

Patch & Configuration Hygiene: Generate monthly patching tickets, confirm completion with infrastructure, and maintain the server software/middleware inventory.

Security Awareness: Run the monthly training cycle, produce completion reporting, escalation outstanding completions, and administer the annual training needs survey. Identify manual control work suitable for automation (asset inventory, ticket creation, evidence extraction, training reporting) and build/commission agentic workflows, with SOPs for each.

Requirements Technical ~5+ years in InfoSec GRC or IT audit in software/regulated services ~ Experience with B2B client security questionnaires/due diligence ~ Working knowledge of GDPR, Quebec Law 25, and PIPEDA ~ Fluent in French and English (due to recurrent contact with international teams and customer) ~ Clear, client/auditor‑ready writing; Nice to Have: CISA, CISSP, CRISC, ISO 27001 Lead Implementer/Auditor ISO 42001 or AI management system exposure Insurance/wealth management industry experience Agentic/Power Automate automation experience Experience managing an MSSP All qualified applicants will receive consideration for employment without regard to race, color, religion, gender, gender identity or expression, sexual orientation, national origin, genetics, disability, age, or veteran status. Equisoft is a global provider of digital solutions for the insurance and investment sectors, trusted by more than 300 of the world’s leading financial institutions.

We offer a comprehensive ecosystem of scalable solutions that help our clients meet the challenges of digital transformation—driven by a business‑centric approach, deep industry knowledge, cutting‑edge technologies, and a multicultural team of experts located across North America, the Caribbean, Latin America, Europe, Africa, Asia, and Australia. #

📌 Security Assurance and Compliance Specialist (Montreal)
🏢 Equisoft Inc. (Canada)
📍 Montreal