Shift delivers AI agents that transform insurers' most critical work. By combining deep industry expertise and unmatched data resources, Shift provides proven results that have earned the trust of hundreds of the world's leading insurers. Our insurance-grade AI is accurate, explainable, and secure—empowering human experts to move with unmatched speed, total confidence, and a renewed focus on the people they serve. Our culture is built on innovation, trust, and a drive to transform the insurance industry through our SaaS platform. We come from more than 50 different countries and cultures and together we are creating the future of insurance. As a Senior GRC Analyst, you will be a cornerstone of Shift’s security program, responsible for developing, maintaining, and assessing our integrated security and privacy management framework. You will manage our compliance with key industry standards, lead risk assessments, oversee our third-party security assurance program, and support TrustOps efforts for customer collateral, questions, contract reviews, and due diligence. This role is critical for ensuring that Shift meets its regulatory obligations and maintains the trust of our customers. As part of the Information Security department, this role reports to the GRC Lead. Shift delivers AI agents that transform insurers' most critical work. By combining deep industry expertise and unmatched data resources, Shift provides proven results that have earned the trust of hundreds of the world's leading insurers. Our insurance-grade AI is accurate, explainable, and secure—empowering human experts to move with unmatched speed, total confidence, and a renewed focus on the people they serve. Your browser does not support the video tag. Our culture is built on innovation, trust,



and a drive to transform the insurance industry through our SaaS platform. We come from more than 50 different countries and cultures and together we are creating the future of insurance. As a Senior GRC Analyst, you will be a cornerstone of Shift’s security program, responsible for developing, maintaining, and assessing our integrated security and privacy management framework. You will manage our compliance with key industry standards, lead risk assessments, oversee our third-party security assurance program, and support TrustOps efforts for customer collateral, questions, contract reviews, and due diligence. This role is critical for ensuring that Shift meets its regulatory obligations and maintains the trust of our customers. As part of the Information Security department, this role reports to the GRC Lead. RESPONSIBILITIES Governance & Policy Management Act as a lead contact to translate Shift’s global information security expectations into actionable policies, standards, and procedures. Promote a mind-set of security and compliance across the organization, transferring knowledge of standards and acting as a subject matter expert (SME). Contribute to the development and support of the security awareness program to ensure it aligns with policy and compliance requirements. Partner with the Data Protection Officer to develop and maintain privacy policies, data handling standards,



and public-facing privacy notices in line with privacy laws and global regulations such as GDPR. Risk Management & Security Assurance Develop and maintain the security assurance plan, ensuring key controls are effectively designed and implemented to meet Shift policies and standards. Improve the third-party information security assurance and continuous assessment process. Identify key risk areas in collaboration with engineering and business teams and facilitate security control evaluations and testing. Review architectural designs and recent initiatives to ensure they align with security policies and effectively mitigate risk. Proactively identify potential information security GRC problem areas and execute plans to improve the overall assurance workflow. Support and facilitate Data Protection Impact Assessments (DPIAs) for new products and initiatives. Compliance & Audits Perform analysis and compile documentation and evidence to demonstrate the compliance level of systems, services, and controls. Support legal and stakeholder teams in responding to Data Subject Access Requests (DSARs) Third-Party Risk Management Develop, execute, and improve the third-party information security assurance and continuous assessment process. Communicate with third parties and suppliers to conduct risk assessments, review their security posture, and manage the remediation of identified issues. 7+ years of proven experience in a GRC, IT Audit, Security Assurance, or Information Security role. Bachelor’s Degree in a relevant field or equivalent work experience. Deep knowledge of security and privacy frameworks is required (e.g., Working knowledge of business continuity, disaster recovery, and incident response planning, including plan structure, exercise and test methodologies. Hands-on experience w

📌 Senior GRC Analyst — Security (Montreal)
🏢 Shift Technology
📍 Montreal