Security Analyst, GRC

We’re seeking a Security Analyst, GRC to join our IT Security team in Vancouver, BC and help strengthen our cybersecurity posture through Governance, Risk & Compliance.

As a member of West Fraser’s Cyber Security team, you will play a critical role in ensuring that this information is secure while enabling technology and business partners to innovate, drive sales, and safely maintain operations throughout our facilities.

The Security Specialist, GRC, takes ownership of assigned workstreams and executes them from start to finish, provides input and feedback to shape requirements and approach, and carries out much of the day-to-day operational work. Areas of focus include SOX IT compliance, security and third-party risk management, attack surface governance, security policies and standards, security awareness and phishing simulations, and GRC reporting, in alignment with regulatory requirements and the NIST Cybersecurity Framework.

This position is instrumental in protecting our organization from the ever-evolving cyber threat landscape and operates under the direct supervision of the Principal Architect, Governance, Risk & Compliance.

You'll Do:

SOX IT Compliance

• Own the execution of assigned IT general controls (ITGC) activities (e.g., user access reviews, change management reviews) to support SOX requirements for the confidentiality and integrity of financial data, including scheduling, coordinating with control owners, and driving remediation of exceptions to closure.
• Prepare and maintain audit evidence, and act as the day-to-day contact for internal and external audit requests on assigned controls.

Security Risk Management

• Conduct security risk assessments for assigned areas and maintain the risk register (risk owners, treatment plans, risk acceptances); track and report on remediation progress.
• Third-party risk: Own the execution of vendor security reviews (intake, risk tiering, due diligence) using security questionnaires, SOC 2 and ISO 27001 reports, and other assurance evidence; track vendor remediation and periodic reassessments, work with Procurement and Legal on contractual security requirements, and recommend process improvements.
• Attack surface: Implement the standards and ownership model for discovering, inventorying, and risk-rating internet-facing and internal assets, and maintain the supporting inventory data; provide input on approach and tooling.
• Attack surface: Track exposures (unmanaged assets, exposed services, misconfigurations, unpatched vulnerabilities) and drive remediation timelines with Infrastructure, Network, and Security Operations; prepare exception requests for review through the risk process.

Policy, GRC Systems and Reporting

• Administer day-to-day operation of the GRC platform used to manage risks, controls, policies, exceptions, and third-party assessments, and implement configuration changes and enhancements as requirements are defined.
• Produce and maintain cybersecurity metrics and key risk indicators (e.g., SOX control status, risk treatment, third-party risk, attack surface exposure, phishing results) for management reporting.

Security Awareness and Phishing Simulations

• Develop and deliver security awareness training across the organization, using a variety of formats to maximize engagement.
• Plan and run regular phishing simulations based on current threat trends, analyze results, and coordinate follow-up training for employees who fall for them.

You Have:

• Minimum of 2 years of experience in Governance, Risk and Compliance, IT audit/assurance, ITGC control execution or support (e.g., access or change management), or third-party risk management.
• Bachelor’s degree in information security, Computer Science, or a related field, or equivalent direct work experience.
• Relevant certifications preferred (e.g., CRISC, CISA, CISM, CISSP).
• Working knowledge of risk management and control frameworks (e.g., NIST CSF, ISO 27001, COBIT, SOX ITGC).
• Experience with security awareness training and phishing simulations; familiarity with third-party risk assessment and vulnerability/attack surface management concepts.
• Experience with GRC platforms (e.g., ServiceNow IRM, Archer, OneTrust) is an asset.
• Excellent communication skills, with the ability to present technical concepts to non-technical audiences and to raise ideas and concerns proactively.
• Ability to take ownership of assigned work and deliver within defined requirements; strong attention to detail and organization, with the ability to manage recurring tasks and deadlines.

Compensation Package:

• The salary range for this position is $65,000 - $103,000 this may vary depending on experience, education, and location.
• Annual bonus opportunity
• Outstanding benefits package including medical, dental, pension, life insurance, disability, accident insurance, vacation, and holidays

Your Workplace Location:

Nestled amidst captivating natural beauty, Vancouver is a city that promises an enchanting experience to its visitors. Its balmy climate, coupled with the warm hospitality of its people, has earned it a reputation as one of the most sought-after tourist destinations in the world. However, Vancouver's appeal doesn't just end there. The city boasts a vibrant cultural scene, with a rich diversity of languages and ethnicities, adding to its unique charm. As one of Canada's most ethnically and linguistically diverse cities, Vancouver is a melting pot of cultures, traditions, and lifestyles, making it an unparalleled place to live.

About Us:

West Fraser offers exciting career paths in trades, operations, professional services, engineering and forestry across more than 50 locations in Canada, the U.S., the U.K. and Europe.

From lumber to engineered wood products, West Fraser delivers high-quality, naturally renewable building materials to the world. In all aspects of our business, we’re committed to responsible product sourcing and harvesting practices, backed by globally-recognized forest certifications.

Diversity:

At West Fraser, we strongly believe promoting diversity and inclusion is essential to our success. Our commitment to creating inclusive workplaces is reflected in our core values, and we constantly strive to foster a culture that values and respects every individual’s unique background and perspective. By joining us, you will have the opportunity to be a part of a team dedicated to shaping a brighter future by embracing diversity and promoting inclusivity. Join our team at West Fraser and help us build a more diverse and inclusive community.

Sustainability:

West Fraser is fully committed to sustainable forest management as defined in our environmental policy, which is reflected in every aspect of our work. We adopt new technologies and innovations to create exceptional building materials. Wood products are a natural, renewable, recyclable, and environmentally sustainable choice for consumers who prioritize sustainability.

Sustainability Report | West Fraser

Learn more about us!

We are West Fraser