Director, Governance, Risk and Compliance (GRC)

The role

This senior individual contributor will lead and operate cybersecurity governance, cyber risk management, compliance, and data governance functions. You will strengthen governance frameworks, oversee cyber risk activities, and support regulatory compliance.

What you will do

• Own and operate the enterprise cyber risk management framework
• Maintain cybersecurity, technology, and data risk registers
• Conduct cyber risk assessments across business processes, systems, vendors, and strategic initiatives
• Define and track key risk indicators, metrics, and remediation activities
• Support post-incident risk reviews and continuous improvement efforts
• Support internal and external audits, regulatory reviews, and customer due diligence requests
• Validate control effectiveness and coordinate audit evidence collection
• Manage cybersecurity policy governance and exception management processes
• Oversee data governance activities including classification, retention, protection, access governance, and recovery controls
• Prepare executive-level cyber risk reporting and governance updates

Required qualifications

• 10+ years of experience in information security, cybersecurity, technology risk, or IT controls
• At least 5 years of direct GRC experience, including 3+ years in a leadership capacity
• Experience within banking, fintech, insurance, payments, wealth management, or another regulated financial services environment
• Proven success operating as a senior individual contributor with ownership of risk assessments, governance documentation, executive reporting, and remediation tracking
• Strong understanding of enterprise cyber risk management, governance, and compliance practices
• Extensive experience with data governance risk management, privacy controls, and information asset protection
• Experience managing cyber risk registers, risk reviews, issue management, and remediation programs
• Strong knowledge of Canadian financial sector regulatory expectations, operational resilience principles, and privacy obligations
• Excellent communication skills
• Bachelor’s degree in Cybersecurity, Information Systems, Computer Science, Risk Management, or a related field, or equivalent practical experience
• Experience supporting audits, regulatory reviews, customer security assessments, and control testing activities
• Strong understanding of identity and access management, data protection, cloud security, vulnerability management, incident response, third-party risk, and business continuity

Nice to have

• Experience within a Canadian regulated financial institution or fintech organization
• Professional certifications such as CISSP, CISM, CRISC, CGEIT, or ISO 27001 Lead Implementer/Auditor
• Experience implementing or enhancing GRC platforms, workflow automation, and reporting dashboards
• Familiarity with PCI DSS, SOC 2, cloud control frameworks, and privacy control frameworks
• Experience mapping controls across multiple regulatory and compliance frameworks

Benefits

• Discretionary annual bonus
• Health and dental plans with 100% of the premiums covered
• Employee Assistance Program
• Retirement savings options
• Hybrid work model
• Reimbursement for tuition assistance and professional development
• Discounts through Perkopolis
• Rewards and recognition programs

Before you apply

• Notify MFSG if you require accommodation for interview materials or procedures

About the company

Momentum Financial Services Group is the team behind Money Mart, Canada’s largest non-bank branch network. They provide financial solutions for underserved communities through products like short-term loans, money transfers, and prepaid cards.