Air Canada is hiring an Analyst, IT & Cybersecurity Risk to support cybersecurity risk management and compliance programs. The role assesses technology and third-party risks and supports control assurance across applications, projects, vendors, and operational processes.

Responsibilities

- Conduct cybersecurity risk assessments for applications, systems, projects, and technology initiatives.
- Assess third-party cybersecurity risks during vendor onboarding, contract reviews, renewals, and ongoing monitoring.
- Review vendor assurance materials, including SOC reports, ISO 27001 certifications, penetration test reports, and security questionnaires.
- Document and communicate risks, control gaps, remediation recommendations, and exceptions; follow up on remediation activities.
- Work with Procurement, Legal, Privacy, Compliance, and business stakeholders on third-party risks and contract security requirements.
- Support third-party cybersecurity incident reviews and maintain assessment records in GRC platforms.
- Support compliance and control assurance, including IT General Controls, PCI DSS, SOC 1, SOC 2, ISO 27001, privacy, audit evidence, and findings tracking.
- Maintain risk registers, compliance dashboards, metrics, and management reporting.
- Prepare risk summaries, assessment reports, dashboards, and presentations, and help improve risk and compliance processes.

Qualifications





- University degree in information security, information technology, computer science, risk management, or a related discipline, or equivalent practical experience.
- Two to four years of experience in cybersecurity, IT risk, IT compliance, IT audit, governance, third-party risk, or a related field.
- Experience with cybersecurity risk assessments, control reviews, compliance activities, third-party risk processes, or vendor security assessments.
- Understanding of internal controls, IT General Controls, SOC 1, SOC 2, PCI DSS, or ISO 27001.
- Familiarity with frameworks such as NIST, COBIT, SOX, GDPR, and PIPEDA, or GRC platforms such as Archer, Optro, AuditBoard, or MetricStream, is an asset.
- Solid analytical, organizational, investigative, written communication, and problem‑solving skills; ability to communicate technical risks to business stakeholders and manage competing priorities.

Conditions of employment

Candidates must be eligible to work in the country of interest when an offer is made and provide proof of eligibility before their start date. Based on equal qualifications, preference will be given to bilingual candidates.

Air Canada is an equal opportunity employer committed to diversity, inclusion, and an accessible and rewarding work environment. Only candidates selected to continue in the process will be contacted.

📌 IT and Cybersecurity Risk Analyst (Dorval)
🏢 Skillhub Solutions
📍 Dorval