[Hiring] Governance, Risk, & Compliance Manager @Inovatec

Role Description

Inovatec is hiring a Governance, Risk & Compliance (GRC) Manager to own the day-to-day execution and continued maturity of our security, privacy, and compliance program. This role is central to our shift from point-in-time audits to continuous, evidence-based control monitoring, anchored in our GRC platform, and to keeping Inovatec audit-ready year-round across various compliance frameworks and providing a high level of assurance to our clients.

You will lead a small, focused team, directly managing our Internal Auditor / GRC Specialist, and the two of you will work shoulder-to-shoulder across all governance, risk, audit, and compliance efforts. You will operationalize governance, run our risk management lifecycle, manage third-party risk, and coordinate internal and external audits. Reporting to the Head of Cybersecurity & Compliance, you will partner closely with Infrastructure, Product Engineering, IT, Legal, Finance, and People & Culture.

What You’ll Do

• Leadership, Management & Accountability (LMA)
  • Directly manage the Internal Auditor / GRC Specialist, owning coaching, priorities, development, and day-to-day workload.
  • Set clear expectations and a steady operating cadence (1:1s, planning, quarterly goals).
  • Champion intent-based leadership, growing the autonomy, judgement, and technical depth of your report.
  • Serve as a hands-on working manager who leads by doing, shares the workload, and steps into complex assessments and audits.
• Governance & Compliance Program
  • Own and continuously mature Inovatec’s GRC program across frameworks like SOC 1 & SOC 2 Type II, ISO 27001, ISO 27018 and TISAX.
  • Drive the transition from point-in-time audits to ongoing control monitoring.
  • Automate evidence collection across active frameworks.
  • Manage the policy lifecycle, covering authoring, review cadence, versioning, and employee policy acknowledgment.
  • Own and mature the privacy, compliance, and security awareness training program.
  • Support AI compliance readiness, including CSA AI validation and ISO 42001 compliance.
• Risk Management
  • Operate the enterprise risk lifecycle, with monthly risk snapshots for historical tracking and audit-ready reporting.
  • Maintain the risk register and support quarterly compliance health reviews and board-level risk reporting.
  • Track remediation against SLAs and drive closure of audit findings and nonconformities.
  • Contribute to the fraud risk program and segregation-of-duties controls.
• Third-Party / Vendor Risk
  • Run the Vendor Risk Management (VRM) program end-to-end.
  • Automate vendor risk assessments for 100% of critical vendors.
  • Enforce third-party information security requirements and confidentiality obligations prior to engagement.
• Audit & Assurance
  • Coordinate internal and external audits, managing scope, evidence, fieldwork logistics, and corrective actions.
  • Maintain the Statement of Applicability, control mappings, and audit calendar.
  • Support client due diligence, and security questionnaires and requests with accurate, evidence-backed responses.

Qualifications

• 6–10+ years in governance, risk, and compliance, information security, or IT audit.
• Direct people-management or team-lead experience.
• Hands-on experience running or maturing programs across SOC 1/2, and ISO 27001/27018.
• Practical experience with a GRC / continuous-compliance platform.
• Strong grasp of risk assessment methodology, control frameworks, and third-party / vendor risk management.
• Experience coordinating external audits and managing remediation of findings to closure.
• Excellent documentation discipline and evidence rigor.
• Strong cross-functional communication skills.

Nice to Have

• Experience working with regulated financial-services clients, SaaS platforms, or enterprise B2B environments.
• Relevant certifications (e.g., CISA, CRISC, CISSP, ISO 27001 Lead Auditor / Implementer).
• Privacy program experience (PIPEDA, Quebec Law 25, ISO 27018).
• Familiarity with the Microsoft / Azure security stack.
• Experience supporting M&A / investor due diligence.

Our Core Values

• Act like an owner: overcome hurdles, seek out solutions, and follow through on commitments.
• Make sound decisions: ensure we have the right facts and focus on solving the right problems.
• Get better every day: apply our passion for innovation to our products and ourselves.
• We before me: act without ego, communicate openly and honestly, and win as a team.