Security GRC Analyst, Mergers & Acquisitions

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a Security GRC Analyst, Mergers & Acquisitions based in Canada. As a Security GRC Analyst specializing in Mergers & Acquisitions, you will play a critical role in integrating acquired companies into an established enterprise security governance, risk, and compliance framework. You will oversee security assessments, evaluate existing control environments, identify compliance gaps, and develop practical remediation strategies tailored to each organization's maturity. Working closely with M&A technology teams, acquired-company leadership, and security specialists, you will ensure that security risks are identified and managed throughout the acquisition lifecycle. You will also help prepare newly acquired entities for external audits while strengthening internal controls and regulatory compliance. This role offers significant ownership, visibility, and the opportunity to build scalable processes from the ground up. It is an ideal opportunity for an experienced security and risk professional seeking to influence complex international acquisitions within a fast-growing financial technology environment. Accountabilities: - Lead security governance, risk, and compliance activities across newly acquired companies, ensuring their control environments are progressively integrated into the organization's enterprise security framework. - Conduct security assessments during the acquisition due diligence process, where timelines allow, or immediately following transaction completion. - Evaluate each acquired company's security posture, including its control environment, identity and access management, infrastructure, third-party dependencies, and previous audit or regulatory examination history. - Prepare comprehensive security assessments against established security baselines, distinguishing between risks that may affect the transaction and those requiring long-term operational remediation.

- Collaborate with M&A Technology teams and deal stakeholders to communicate security findings, identify integration requirements, and estimate the resources needed to address control deficiencies. - Map existing controls within acquired entities to internal security frameworks and applicable external standards, identifying gaps, overlaps, and opportunities for alignment. - Determine which existing organizational policies and controls can be extended to acquired entities, which require specific adaptations, and where new policies or controls must be introduced. - Assess control maturity at the entity level, document supporting evidence, and establish realistic remediation plans based on the acquired organization's size, capabilities, and current maturity. - Define measurable remediation milestones, including clear deadlines, accountable owners, and expected risk reduction outcomes. - Prioritize remediation activities according to risk severity and potential business impact rather than simply following framework requirements or addressing the easiest gaps first. - Monitor remediation progress, maintain regular follow-up with control owners, and escalate overdue activities or significant risks to Security GRC leadership. - Prepare proposed risk acceptance decisions, documenting their rationale and compensating controls for leadership review and approval. - Maintain acquired-entity risks within the enterprise risk register and ensure accurate, up-to-date reporting. - Prepare acquired companies for inclusion in external audit scopes by coordinating evidence collection, documentation, and audit walkthrough support. - Serve as the primary Security GRC contact for acquired-company leadership, finance teams, internal auditors, and other relevant stakeholders.