EarthDaily is seeking a Vancouver-based Governance, Risk, & Compliance (GRC) Manager to lead its GRC program and support the company’s public‑company readiness efforts.Job OverviewThe GRC Manager establishes, maintains and continuously improves EarthDaily’s governance, risk, and compliance program. This is a hybrid position with occasional travel for audits, meetings and vendor assessments.Key ResponsibilitiesRisk Management and GovernanceOwn the enterprise risk register, conduct risk assessments and present findings, mitigation plans and residual risk levels to decision makers.Escalate risk acceptance, security variance approvals and policy exceptions to the appropriate owner based on risk type and organizational impact.Identify gaps in processes, documentation or controls through stakeholder interviews and process walkthroughs and take ownership of addressing them.Policy Lifecycle ManagementManage the policy lifecycle across IT and information security policies, supporting Finance and Internal Controls in maintaining ICFR‑related policies.Adapt policy templates to reflect organizational realities while coordinating annual reviews, version control and approval tracking.Review contractual agreements for GRC‑related requirements and ensure compliance obligations are identified, documented and tracked.SOX and Public‑Company ReadinessOwn the IT general controls component of SOX 302 and 404, including scoping, documentation and remediation tracking.Provide IT inputs to disclosure controls and procedures (DC&P;) supporting executive certification requirements.Contribute to cybersecurity disclosure readiness aligned with Regulation S‑K and Form 8‑K.Coordinate tabletop exercises and incident response walkthroughs to validate incident readiness and key control effectiveness.Audit Readiness and Compliance EvidenceCollect and organize evidence artifacts to support compliance audits and certification efforts.Serve as a primary liaison with internal and external auditors, coordinating evidence requests and remediation follow‑up.Third‑Party Risk and PrivacyManage third‑party risk by coordinating vendor security assessments and tracking contract security provisions.Coordinate with regional privacy stakeholders to ensure alignment on data protection practices.Monitoring, Access Reviews and ReportingMonitor initiatives for compliance, cybersecurity and controls implications, engaging proactively when projects involve customer data or new applications.Coordinate privileged access reviews, user access certifications and other recurring IT general control activities.Generate compliance metrics, remediation status and readiness reports for leadership.QualificationsBachelor’s degree in Information Security, Computer Science, Business Administration, Accounting, or related field.5+ years of experience in IT security, risk management, compliance or audit roles.3+ years of direct experience with GRC programs, policy management or audit preparation.Experience with SOC 2, NIST CSF, ISO 27001, and SOX/ICFR controls.Familiarity with SOX Sections 302 and 404 and IT general controls.Liaison experience with external auditors or certification efforts.Professional certifications such as CISA, CRISC, CISSP, CISM, or CGRC are preferred.Working knowledge of COSO 2013 Internal Control – Integrated Framework.BonusExperience with GRC platforms such as Vanta, Drata or ServiceNow GRC.Background in IT administration or technical operations, including comfort with system admin consoles and scripting languages.Experience supporting compliance in high‑growth or regulated environments, including IPO readiness or SEC cybersecurity disclosure support.Experience in technology,



SaaS or data‑intensive industries.Your ToolkitStrong knowledge of SOC 2, NIST and ISO 27001 and how they intersect with IT general controls.Working knowledge of the COSO 2013 framework and SOX 302/404 application to IT controls.Working knowledge of identity and access management platforms such as Okta or Azure AD.Comfort pulling configuration details, audit logs and compliance data from SaaS platforms to assemble audit‑ready evidence.Experience with risk assessment methodologies and risk register management.Familiarity with GDPR, CCPA and cloud security concepts across SaaS, IaaS and identity platforms.Self‑sufficient, highly organized, and able to manage multiple concurrent workstreams independently.Excellent written and verbal communication skills, including the ability to convey compliance requirements clearly to technical and non‑technical audiences.Resourceful, persistent and resilient, with the ability to follow up, escape escalation when necessary and drive initiatives across competing priorities.Builds credibility and productive working relationships across IT, Legal, Finance, Internal Controls, Engineering and business teams.CompensationBase Salary Range: $130,000 to $150,000 CAD annually, based on Vancouver, BC market. Individual placement within the range is determined by experience, skills and qualifications.BenefitsCompetitive compensation, full benefits and flexible time off.Hybrid work arrangements with occasional office presence and remote collaboration.Company‑subsidized lunches, lunch & learn sessions and Friday afternoon social hours.Work from home opportunities (hybrid).Great work workplace and office location over the water in Vancouver.#J-18808-Ljbffr

📌 Governance, Risk & Compliance Manager - C$130,000 - C$150,000 A Year (Winnipeg)
🏢 EarthDaily
📍 Winnipeg