About the role

The Security & Compliance Analyst helps keep Jesta I.S. secure and audit-ready for its clients. The role coordinates SOC 1 and SOC 2 audits with external auditors and supports vulnerability management, penetration testing, ISO 27001:2022 alignment, and day-to-day security operations, using AI-assisted tools such as Microsoft Copilot and Microsoft Security Copilot. It sits in Operations, reports to the IT Director, works with the IT, DevOps, Support, and Infrastructure teams, and is based in Montréal, QC, with a hybrid work model.

About Jesta I.S.

Jesta I.S. makes ERP software for apparel, footwear, and soft-goods companies. For over 50 years, we have built, implemented, and supported end-to-end suites for retailers, wholesalers, and brands worldwide. Vision Suite and FarsightIQ cover merchandising, planning, supply chain, and omni-channel operations on a single master data foundation. We are headquartered in Montréal, our team comes from over 40 countries, and some of our client relationships go back more than 30 years. We are now moving to a composable architecture built on APIs and microservices, and adding AI-enabled forecasting and workflow automation.

Tech setting

- Architecture: On-premises Windows and Linux servers, workstations, and network appliances; Microsoft Azure (VMs, containers, PaaS); AWS (EC2, Lambda, and other managed services); Oracle Cloud Infrastructure (OCI) compute instances aligned with OCI security baselines.
- Integrations: Cisco AMP, Cisco Umbrella, Microsoft Defender for Endpoint (EDR), Microsoft Defender XDR, Microsoft Defender for Cloud (Azure), AWS Security Hub / GuardDuty, Oracle Cloud Guard, Microsoft Entra ID (MFA, Conditional Access), and Microsoft Sentinel or an equivalent SIEM.




- Process: SOC 1 and SOC 2 audits, ISO 27001:2022, patch management, vulnerability management, and penetration testing, documented in SharePoint, Microsoft Teams, and Outlook.
- AI: Microsoft Copilot or equivalent approved AI tools; AI-assisted security tools such as Microsoft Security Copilot or equivalent.

Responsibilities

- Act as primary liaison between internal teams and external auditors for SOC 1 and SOC 2 audits, and track control owners' responses and audit timelines.
- Collect, validate, and organize control evidence, and keep audit documentation current and easy to find.
- Partner with infrastructure and support teams to implement and maintain security controls, and track compliance, exceptions, and remediation timelines.
- Monitor security alerts, analyze logs, and investigate in SIEM/XDR; triage incidents, detect threats, and support critical cybersecurity incident response (CIRT/P1).
- Coordinate patch management across on-premises and cloud environments.
- Scan for vulnerabilities and analyze security advisories (CISA, Microsoft); prioritize by risk, track remediation, and validate fixes across on-premises and cloud environments.
- Plan and coordinate internal and external penetration tests (scope, timing, objectives); track findings to closure, validate remediations, and maintain reports, evidence,



and follow-up documentation.
- Analyze telemetry from endpoint, network, and cloud-native tools; recommend actions and tune detections to reduce false positives.
- Work with IT, DevOps, and cloud teams on configuration, coverage, and response workflows.
- Automate tasks to reduce downtime and improve deployment consistency.
- Support security initiatives, risk assessments, control testing, ISO 27001:2022 alignment, and continuous improvement of the security and compliance program.
- Use Microsoft Copilot and AI-assisted security tools for analysis, drafting, documentation, log analysis, incident investigation, threat intelligence, vulnerability analysis, and security reporting; validate AI-generated output before acting on it.
- Own SOC 1 and SOC 2 compliance programs, including readiness planning and continuous control improvement, and lead organization-wide audit coordination as primary contact for external auditors.
- Lead penetration-testing strategy, remediation validation, and reporting to leadership.
- Mentor junior analysts and guide cross-functional teams on security and compliance best practices.
- Contribute to security governance, framework alignment (ISO 27001, NIST, CIS), and long-term risk reduction.

Requirements

- 2+ years of relevant security and compliance experience, including SOC 1 / SOC 2 audit involvement in a tech or software company and hands-on security operations (6+ years for senior level).
- Strong grasp of internal controls, risk management, and audit processes.
- Practical knowledge of ISO 27001:2022, including ISMS, security risk assessments, control implementation, audit evidence, and continuous impr

📌 Security & Compliance Analyst | Analyste en sécurité et conformité (Montreal)
🏢 JESTA I.S.
📍 Montreal