Powerex Corp., the wholly owned energy marketing subsidiary of BC Hydro, is responsible for marketing clean electricity across North America. Cybersecurity is fundamental to maintaining the reliability, integrity, and availability of the systems that support our business.

Our Cybersecurity team is building a dedicated Governance, Risk & Compliance (GRC) function to strengthen oversight, accountability, and risk visibility across the organization. We are looking for an experienced Cybersecurity GRC Analyst to take ownership of this function and work directly with the Director of Cybersecurity to mature our GRC practices.

This role is well-suited to a cybersecurity GRC professional who brings hands‑on experience in risk management, policy, compliance, and vendor risk, and who is ready to make a tangible impact — from shaping how we track and communicate risk to driving our cybersecurity awareness and compliance programs.

Why Join Powerex?

- Take ownership of a recent GRC function at the heart of Powerex’s cybersecurity program, with direct influence on how cybersecurity risk is managed and communicated.
- Work closely with the Director of Cybersecurity and shape the maturity of our governance, risk, and compliance practices.
- Develop broad impact across governance, policy, risk, compliance, vendor management, and cybersecurity awareness.
- Influence how Powerex communicates its cybersecurity posture to executive leadership and the board.
- Flexible hybrid model (as little as 2 days in the office), comprehensive compensation, pension, and benefits package.

Key Responsibilities

Governance & Reporting

- Prepare quarterly cybersecurity reports for IT governance committees and the board,



and coordinate the quarterly IT Cybersecurity Governance meetings — including agendas, action tracking, and follow‑up.
- Maintain a clear overview of the cybersecurity program and budget, act as the liaison between the cybersecurity team and the PMO, and coordinate recurring annual cybersecurity activities such as tabletop exercises, penetration tests, and policy reviews.

Policy & Standards

- Maintain the policy register and own the end‑to‑end policy lifecycle — from drafting and scheduled reviews to exception management and sign‑off — ensuring all policies are current, documented, and accessible in Confluence.
- Coordinate policy communication and sign‑off campaigns with HR and business stakeholders, and work with the CS director and IT leaders to identify gaps and drive the creation of new policies where needed.

Risk Management

- Own the cybersecurity risk register: ensure risks are logged with clear ownership and ratings, facilitate monthly risk reviews with the team, and prepare quarterly risk summaries — including risk themes and mitigation status — for governance and board‑level reporting.
- Drive the formal risk acceptance process, ensuring risks without planned mitigations are documented and approved by an accountable owner, and that the risk register remains a reliable, up‑to‑date source of truth.

Third‑Party Risk Management (TPRM)





- Manage the vendor register and own the end‑to‑end TPRM lifecycle: coordinate onboarding assessments using standardized questionnaires, administer Third‑Party Access Policy acknowledgements, and drive annual re‑assessments and collection of security certifications.
- Maintain vendor offboarding checklists and confirm that access revocation and data handling steps are completed, ensuring Powerex’s third‑party risk exposure is well‑documented and continuously managed.

Compliance & Audit

- Track all audit findings in the risk register with named owners and remediation timelines, prepare compliance status updates for quarterly governance reporting, and coordinate internal self‑assessments against the cybersecurity standard and NIST CSF.
- Monitor relevant external requirements — including PIPA, cybersecurity insurance expectations, and external audit requirements — to ensure the necessary controls are in place and documented.

Cybersecurity Awareness

- Design and deliver the annual cybersecurity awareness program, organize Powerex’s participation in Cybersecurity Awareness Month, and track engagement metrics for reporting to the CS director and quarterly governance meetings.
- Produce quarterly awareness summaries — covering participation rates, simulation click rates, and trends — and coordinate targeted follow‑up with managers or HR for staff who repeatedly fail simulations or have not completed awareness activities.

Key Qualifications

Required

- Bachelor’s degree in Information Security, Computer Science, Engineering, or a related technical field (or equivalent practical experience).

📌 Cybersecurity GRC Analyst (Vancouver)
🏢 Powerex
📍 Vancouver