Cybersecurity Governance Analyst

About Codan (Canada) Inc.

Founded in 2009, Codan (Canada) Inc. (CCI) is affiliated with Conyers, an offshore law firm operating in multiple global financial jurisdictions including Bermuda, Cayman Islands, British Virgin Islands, Hong Kong, Singapore, and London.

Role Overview

The Cybersecurity Governance Analyst will spearhead the development and continual enhancement of Conyers' cybersecurity governance and assurance initiatives. This role supports the firm's information security management frameworks, third-party risk management procedures, regulatory mandates, and client security assurance requirements. The position ensures that all cybersecurity governance efforts are effective, auditable, and aligned with the overall business goals.

Key Responsibilities

• Assist in creating, deploying, and managing Conyers' information security governance framework.
• Coordinate governance-related activities focused on ISO/IEC 27001 management systems.
• Update and maintain security-related policies, standards, procedures, and documents.
• Manage periodic policy reviews and obtain governance approvals.
• Oversee the vendor security assessment program including conducting due diligence on current and prospective suppliers.
• Monitor remediation actions identified in vendor assessments and maintain detailed third-party risk logs and reports.
• Maintain and update cybersecurity risk registers and treatment action plans.
• Organize risk assessments, control reviews, and assist in both internal and external audit processes.
• Track and monitor progress of remediation activities to closure; generate governance and management reports and dashboards.
• Coordinate responses to client cybersecurity questionnaires and security due diligence inquiries.
• Maintain evidence repositories for client and regulatory assurance documentation.
• Provide support for regulatory reporting demands and client audits.
• Manage and track cybersecurity governance projects, action plans, and remediation tasks, including documentation and audit trails.
• Facilitate governance meetings and ensure follow-up on action items.
• Drive continuous improvement initiatives across the firm's cybersecurity program.

Candidate Profile

• Between 3 to 5 years of experience in information security governance, compliance, risk management, cybersecurity assurance, or audit.
• Hands-on experience maintaining an Information Security Management System (ISMS), preferably ISO/IEC 27001 aligned.
• Skilled in conducting security assessments of vendors and third parties, managing remediation efforts.
• Experienced in responding to client security questionnaires, audits, and regulatory information requests.
• Exceptional written communication and documentation skills, capable of producing clear policies, procedures, risk assessments, reports, and governance documentation.
• Able to translate complex technical security concepts into comprehensible business terms for stakeholders.
• Strong organizational aptitude with the ability to coordinate multiple governance and assurance activities simultaneously.
• Experienced in maintaining risk registers, tracking remediation actions, and supporting audit and compliance reviews.

Preferred Qualifications

• Familiarity with ISO/IEC 27001, NIST Cybersecurity Framework, or comparable governance standards.
• Experience within professional services, legal, financial services, or regulated sectors.
• Knowledge of AI governance, data protection, privacy, or cloud security governance.
• Relevant certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CRISC, CISSP, Security+ or equivalent.

Equal Opportunity & Accommodations

Codan (Canada) Inc. is an Equal Opportunity Employer committed to providing accommodations for applicants with disabilities during the hiring process. Candidates requiring accommodations are encouraged to notify the employer accordingly.