Movojobs
Back to results

Added

Kruger Inc.

Cybersecurity Governance, Risk & Compliance (GRC) Lead

  • Montreal, QC, Canada

Full-time

Apply About employer

Applications open in a new tab.

Job details

Job type
Full-time
Apply by
Experience
8 to 10 years or more of professional experience in cybersecurity governance, risk management, or compliance, including 3+ years leading a practice.
Posting language
English
Posted

Original job description

Position Overview

The Cybersecurity GRC Lead is responsible for supporting and advancing the cybersecurity governance, risk, and compliance practices within Kruger's Digital and IT Group. The incumbent serves as the senior operational leader for GRC, leading the design and continuous improvement of the cybersecurity governance framework, overseeing cybersecurity risk and compliance programs, and developing and mentoring the GRC capability, including people, methodologies, and tools. The role also supports audit and regulatory interactions through structured analysis, consolidated risk reporting, and well-founded recommendations.

This position reports directly to the Director of Cybersecurity, who is responsible for the role's day-to-day leadership, priorities, and performance. The position also maintains a dotted-line relationship with the Vice President, Legal Affairs, to ensure alignment on regulatory compliance, legal risk, and matters requiring legal guidance or escalation.

Responsibilities

 Cybersecurity Governance

  • Develop, maintain, and communicate cybersecurity policies, standards, and guidelines aligned with enterprise objectives and industry frameworks (NIST CSF, ISO 27001, CIS Controls, SCF).
  • Run the operational governance cadence (working committees, policy reviews, control maturity assessments) and prepare the associated reporting.
  • Define the cybersecurity KPI framework and provide visibility into performance and risk exposure.

Cybersecurity Risk Management

  • Oversee the cybersecurity risk assessment program across IT, OT, and cloud environments; perform assessments on the most complex or strategic scopes.
  • Own the cybersecurity risk register: ensure risks are properly categorized, prioritized, and assigned to risk owners, and consolidate the risk posture.
  • Collaborate with risk owners to define and monitor risk treatment plans; escalate risks that exceed tolerance levels.
  • Own the third-party risk management program (methodology, vendor tiering, oversight of assessments) covering vendors and suppliers.
  • Lead the cybersecurity resilience workstream within Business Impact Analysis (BIA), Business Continuity (BCP), and Disaster Recovery (DR) exercises, including scenario testing and lessons learned.

Cybersecurity Compliance & Audit

  • Own the cybersecurity compliance covering internal policies, standards, and regulatory requirements.
  • Act as operational lead for cybersecurity audits (internal, external, regulatory), including evidence collection, remediation governance, and auditor relationships.
  • Maintain up-to-date knowledge of evolving regulations and advise on their impact.

Cybersecurity Advisory

  • Act as a trusted advisor by providing structured analysis, metrics, and actionable recommendations.
  • Prepare Board-ready materials and executive presentations for IT Leadership.
  • Build strong working relationships with stakeholders to ensure a consistent approach to cyber risk.
  • Promote a culture of accountability and continuous improvement in cybersecurity governance.

Qualifications

  • Bachelor’s degree in information security or a related field.
  • Certifications such as CISM, CRISC, CISSP, ISO 27001 Lead Implementer/Auditor, or equivalent; CISM or CRISC preferred.

Experience

  • 8 to 10 years or more of professional experience in cybersecurity governance, risk management, or compliance, including 3+ years leading a practice.
  • Proven track record owning risk registers, compliance programs, and audit engagements.
  • Experience working with multidisciplinary teams across IT, OT, Legal, Audit, Business functions.

Skills And Abilities

Technical Skills

  • Solid understanding of cybersecurity frameworks (NIST CSF, ISO 27001, CIS Controls, SCF) and risk methodologies (EBIOS, FAIR).
  • Knowledge of regulatory requirements, including GDPR, Law 25, and NERC.
  • Familiarity with GRC tools and platforms is an asset.

Business and Leadership Skills

  • Strong analytical and critical thinking skills.
  • Ability to synthesize and present complex information to executives in clear business terms.
  • Excellent organizational and stakeholder management skills.
  • Collaborative, diplomatic, and detail-oriented mindset.
  • Leadership and coaching skills; ability to influence without formal authority across business units.
  • Comfort operating with ambiguity and arbitrating competing priorities.

LANGUAGES

  • Fluent in both English and French (written and spoken).

Knowledge of English is required for this specific position as Kruger deals with partners across North America and the successful candidate will be required to communicate frequently with them. Kruger has taken all reasonable steps to avoid imposing English language requirements, including assessing the actual language needs associated with the duties to be performed, ensuring that the language skills already required of other employees were insufficient for the performance of those duties, and limiting as much as possible the number of positions with duties requiring English language skills.
Apply About employer
More about this job

Responsibilities

Lead and continuously improve the cybersecurity governance framework, risk and compliance programs, risk register, third-party oversight, and audit activities across IT, OT, and cloud environments. Advise leaders and stakeholders through structured risk analysis, executive reporting, resilience exercises, and actionable recommendations.

Requirements

Requires a bachelor’s degree in information security or a related field, plus 8–10 or more years of relevant experience, including at least three years leading a practice. Candidates should have a relevant cybersecurity certification, experience owning risk and compliance programs and audits, knowledge of cybersecurity frameworks and regulations, and fluency in English and French.

Skills

  • Cybersecurity Governance
  • Cybersecurity Risk Management
  • Compliance Management
  • Risk Assessment
  • Risk Register Management
  • Third-Party Risk Management
  • Audit Management
  • Business Continuity
  • Disaster Recovery
  • NIST CSF
  • ISO 27001
  • CIS Controls
  • SCF
  • Executive Communication
  • Stakeholder Management
  • Leadership And Coaching

Visa sponsorship

Not detected in the job text

Categories

  • Technology
  • Security & Safety
  • Management & Leadership
  • Legal

Keywords

  • Cybersecurity Governance
  • Risk Management
  • Compliance
  • NIST CSF
  • ISO 27001
  • CIS Controls
  • SCF
  • EBIOS
  • FAIR
  • CISM
  • CRISC
  • CISSP
  • GDPR
  • Law 25
  • NERC
  • GRC Tools
  • Risk Register
  • Third-Party Risk Management
  • IT
  • OT
  • Cloud Environments
  • Internal Audit
  • External Audit
  • Regulatory Audit
  • Business Impact Analysis
  • Business Continuity
  • Disaster Recovery
  • Risk Treatment Plans
  • Control Maturity Assessments
  • Cybersecurity Resilience

Report this job