Risk and Compliance Specialist

Salary Range: 80000 to 105000 (Currency: CAD) (Pay period: per-year-salary)

BIS Safety Software is a SaaS company on a mission to change how organizations manage safety, learning, and compliance. Our clients trust us with their people's training records and personal information, and we take that trust seriously. We are looking for a Risk and Compliance Specialist to own our compliance program day to day: the audits, the controls behind them, and the risk calls that keep us on side all year.

About the Role:

This is a role for someone who already knows compliance and is ready to own it, not just support it. Audit season matters, but the real work happens in the months between. You’ll keep our program sharp so the audit itself is the easy part.

You’ll also be the go-to voice on risk, data, and privacy across the company. One day that’s a tricky client request, the next it’s a vendor decision or a security question that needs an answer by end of day.You’ll help shape how BIS handles trust, and every team here will feel your work.

This is an in-person role based out of our Sherwood Park, Alberta office.

In this role, you'll be expected to:

• Help lead our SOC 2 audit and PCI DSS attestation, scoping the work, assigning action items across departments, following up on deadlines, and collecting the evidence that gets us through cleanly
• Own control documentation for each framework and work with every team to confirm their controls are current and holding up
• Lead and contribute to risk assessments across the business, documenting risks, recommending mitigation, and following through until each one is resolved or escalated
• Review in-scope vendors that handle personal information, financial data, or client data
• Manage the Risk and Compliance and Privacy inboxes, answering client tickets on privacy, data, and personal information with clear, accurate guidance
• Keep our privacy policy, terms and conditions, and subprocessor list current, and flag when changes in law or the industry mean something needs a second look
• Complete the privacy, data security, and data retention sections of RFPs and security questionnaires
• Partner with IT and Technology on risk, offering practical solutions, separating true must-haves from best-practice suggestions, and teaching along the way
• Coordinate quick cross-team reviews when an urgent issue or emerging risk lands

You might be the right fit if you:

• Catch what's missed. Attention to detail is the single most important trait for this role, and you look past the original ask to see the whole picture
• Have kept a SOC 2 program running, not just sat in on the audit, and can walk through what good pre-audit prep looks like
• Juggle many large projects at once with an audit lens: dozens of action items, several departments, and different deadlines, all tracked and closed out on time
• Speak up. You're comfortable raising considerations when it matters, and you know how to make your case
• Ask the right questions first. You figure out what's actually needed, and how much it matters to the client, before committing hours to it
• Shift gears when something urgent lands without losing track of everything else
• Adapt your approach to the situation instead of applying one way of doing compliance to every problem
• Own the work without waiting for permission or step-by-step direction
• Build real working relationships across teams, because this role touches almost every department here

Qualifications we are looking for:

• 2+ years of hands-on compliance experience
• SOC 2 experience, including maintaining ongoing control documentation and coordinating audit deliverables across departments
• PCI DSS and/or GDPR experience
• Strong data fluency: subprocessors, data controllers vs. processors, data governance and retention, and how information flows across systems
• Post-secondary education in a relevant field, or equivalent experience
• Tech-savvy and comfortable working with AI tools, as you'll be in our software every day and use AI to support compliance work
• Experience with Microsoft 365

Bonus points if you have:

• An IT, SaaS, or software-side compliance background, especially around data management and data controls
• Privacy knowledge, including Canadian privacy law
• Certifications such as CIPP/C or CIPM
• Cybersecurity knowledge
• Experience completing RFPs or security questionnaires

Compensation and benefits:

• Employee Stock Ownership Plan (ESOP)
• Full medical, dental, and vision coverage
• Life insurance and disability insurance
• Health spending account
• Flexible working hours
• On-the-job training and growth opportunities
• Free on-site parking