Specialist of Security Risk Management

Join Wealthsimple, a fast-growing fintech company, as a Specialist in IT/Security Risk Management. In this hands-on role, you will be responsible for identifying, assessing, and tracking risks across Wealthsimple's technology and security landscape. You will work closely with various teams to maintain the risk register and drive risk treatment activities. This position offers a competitive salary, equity options, and a comprehensive benefits package.

• Support the end-to-end IT and security risk management lifecycle, including risk identification, assessment, treatment tracking, and reporting.
• Maintain and continuously improve the enterprise IT/security risk register, ensuring risks are accurately documented, rated, and assigned to appropriate owners.
• Perform risk assessments across technology domains (cloud infra, access management, application security) and third-party assessments using the appropriate methodology for each.

• Familiarity with key technology risk domains including cloud (AWS preferred), identity and access management and vulnerability management
• Experience maintaining risk registers and supporting risk assessment processes
• Experience conducting third-party and vendor reviews, with knowledge of due diligence review methodology, is an asset
• Self-starter who can operate independently, manage competing priorities, and drive work to completion
• Working knowledge of compliance frameworks such as SOC 2, PCI DSS, and/or NIST is a strong asset
• Comfortable working cross-functionally with both technical and non-technical stakeholders
• Experience with GRC tools and risk management platforms (e.g.Jira, Drata) is an asset
• Strong analytical and written communication skills, with the ability to translate technical risk findings into clear business language
• Relevant certifications are an asset (CRISC, CISA, CISSP, or equivalent)
• 3–5 years of experience in IT risk management, information security, or a related GRC function, ideally within financial services or fintech
• Solid understanding of IT and security risk frameworks such as NIST CSF, ISO 27001, or FAIR