Senior Governance, Risk and Compliance Analyst-Cyber Security

Inspirational, innovative and entrepreneurial - this is how we describe our empowered teams. Combine your passion with purpose and join a culture that is thriving in the face of change.

 National in scope and local in focus, MNP is one of Canada’s largest professional service firms providing client-focused accounting, consulting, tax, and digital services to clients. Founded in 1958, MNP today is a CAD 2 billion+ organization with 10,000+ employees and 150+ offices across Canada. MNP prides itself on being an ‘advisor’ to its clients (individuals, businesses, and organizations), focusing on their success by delivering personalized strategies and solutions that help clients reach their full potential — wherever business takes them.

 MNP set up MNP Spark, its Global Capability Centre (GCC), in Bengaluru in May 2025 with a focus on enabling the Firm drive growth, efficiency, customer delight, and innovation, by leveraging high quality talent in India. MNP Spark is like any other MNP region/office — front facing, client focused but working with all MNP regions in Canada to deliver services.

 Make an impact with our Technology - Cyber Security team as a Senior Governance, Risk, and Compliance (GRC) Analyst. This diverse team of tech-savvy problem solvers enables MNP to take a proactive and prepared approach to cyber crime and capitalize on new technologies and innovations. As a trusted advisor, you’ll investigate threats, develop policies, and enhance infrastructure to minimize the impact of security-related events to protect MNP's business operations and reputation.   

Responsibilities

·       Support the development and implementation of the cybersecurity risk management program, aligned with the Firm’s acceptable risk tolerance.

·       Develop, maintain, and improve cybersecurity policies, standards, procedures, and control requirements; coordinate reviews, approvals, communication, and exceptions, and ensure stakeholder compliance.

·       Conduct business impact analyses and risk assessments across applications, cloud services, infrastructure, vendors, new projects, initiatives, and mergers and acquisitions.

·       Document findings for risk assessment report review and approval; maintain the risk register and track findings through treatment, acceptance, and remediation.

·       Assess control design and effectiveness against applicable frameworks and regulatory obligations, recommending improvements to security posture; support audits, evidence collection, findings management, and issue closure.

·       Perform third-party security assessments of vendor documentation, compliance reports, and contractual security obligations; communicate findings to business and procurement stakeholders.

·       Advise technical and business stakeholders on day-to-day activities and on cloud, AI, application, infrastructure, and third-party risks, translating findings into business impact and actionable remediation plans.

·       Support maturity assessments, framework mapping, control rationalization, security awareness, and governance improvements.

·       Define and report KPIs, dashboards, and leadership metrics for risk and compliance management, cybersecurity training, and awareness.

Skills and Experience

·       Experience: 10 to 15 years  of IT and cybersecurity experience, including at least 5 years in a senior risk management or internal audit role.

·       Governance and compliance: Cybersecurity policy management, regulatory assessments, control testing, audit support, evidence management, and risk and compliance reporting.

·       Risk management: Enterprise cybersecurity, technology, and cloud risk assessments; business impact assessment, risk treatment, registers, and exception management, backed by strong knowledge of risk assessment and internal audit frameworks.

·       Third-party risk: Vendor due diligence, SaaS and cloud security reviews, contractual security requirements, and supply-chain risk management.

·       Frameworks and standards: Proven ability to apply frameworks and controls such as NIST CSF, CIS Controls, SOC 2, PCI DSS, and privacy and data governance frameworks.

·       Technology knowledge: Cloud security (AWS and Azure), identity and access management, security operations, vulnerability management, security architecture, data protection and privacy, AI governance and security, and application security and secure development practices.

·       Significant experience in cybersecurity governance, risk management, compliance, audit, security consulting, or related disciplines.

·       Practical experience conducting risk assessments and control evaluations.

·       Strong analytical, documentation, organizational, written communication, and technical reporting skills.

·       Ability to communicate with technical and non-technical stakeholders and influence decisions through collaboration, evidence, and sound risk management.

·       Experience working with global stakeholders across India and Canada time zones, ideally in a professional services or regulated environment.

·       Experience managing multiple assessments and competing priorities.

Educational Qualifications

·       Bachelor’s degree in cybersecurity, information technology, risk, audit, or related discipline, or equivalent practical experience.

Certifications

·       CISM, CISSP, CRISC, CISA, or other relevant security certifications are considered an asset. Equivalent experience and demonstrated expertise are also highly valued.