Software Risk and Compliance Analyst

Résumé du poste

The analyst will conduct risk assessments for new software features and ensure ongoing compliance with frameworks like SOC 2, PCI DSS, and GDPR. They will work closely with product and technology teams to verify software behavior and maintain audit readiness throughout the development lifecycle.

Détails du poste

BIS Safety Software is a SaaS company on a mission to change how organizations manage safety, learning, and compliance. Since 2006 we've been building software in a space where trust and data integrity matter, and we're looking for a Software Risk and Compliance Analyst who will be embedded with our technology and product teams, focused entirely on the software itself. ABOUT THE ROLE You'll be in the room with product and technology every day, knowing the software as well as the people building it, and making sure that new modules, feature improvements, and changes to how data moves keep us aligned with PCI DSS, SOC 2, GDPR, and the data governance commitments we make to our clients. Risk gets identified while a feature is still being sketched out, the right requirements land in the case up front, and nothing stalls later because a compliance question surfaced too late. When scope shifts partway through, you're the one who notices that what was approved is no longer what's being built. You'll have the autonomy to raise a concern to anyone here, and we'll expect you to use it. We'll also expect you to bring a way forward. The job is enablement, not gatekeeping, and the difference matters to us. You'll spend a lot of your time in project tickets and inside the software. The people who love this role are the ones who find that genuinely interesting. This is an in-person role based out of our Sherwood Park, AB office. \n In This Role, You Will Be Expected To: * Risk assessments: own the assessments for new features, new modules, and any change to how our software collects, stores, or moves data. * Early involvement: join feature mapping and product planning sessions, ask the questions that surface risk before development starts, and get the right requirements written into the case. * Ticket to ship: follow cases through their full life, watch for scope creep, and re-review when something changes so approvals stay valid. * Hands-on verification: work in the software yourself to confirm it behaves the way our documentation and our controls say it does. * AI features: assess how AI capabilities in our product handle personal data, where that data is processed, and whether it stays within the boundaries we've committed to. * AI in the build: join the conversations about how we connect AI tools to our data, asking where information gets processed, what a model can reach, and how it stays contained. * Audit readiness: review what has changed ahead of our SOC 2 and PCI DSS cycles, confirm our controls still match reality, and close gaps before an auditor finds them. * Practical solutions: partner with developers and product to find a compliant path forward so work keeps moving. You Might Be the Right Fit If You Are: * Experienced with a background in risk, compliance, privacy, or data governance * Detail-oriented to an unusual degree, the person who reads a case and catches what nobody addressed * Experienced in digging until you actually understand it, especially when it comes to how data moves through a system * Willing to speak up and stay with it, raising a concern clearly and following through until it's resolved * Able to see the second-order impact, the other module, the other commitment, the thing this quietly touches * Following AI and privacy developments on your own, closely enough to spot when a new capability changes the risk picture * Drawn to technology and happy spending your days in project tickets and software * Curious about how AI works underneath the demo, enough to ask whether a tool is doing what it claims with our data * Self-directed, comfortable with autonomy and setting your own priorities * Solution-minded, arriving with options rather than only objections Qualifications we are looking for: * A background in risk, compliance, privacy, data governance, or information security. * Working familiarity with at least one control framework or privacy regime, such as SOC 2, PCI DSS, GDPR, ISO 27001, or something comparable * Strong technical aptitude and real curiosity about how software works under the hood, including how data is stored, transmitted, and shared between systems * Experience with the privacy and data governance questions that come with AI features: what data a model can reach, where it's processed, and what leaves our environment. * Comfort working day to day in project management and ticketing tools, following a case from scoping through to release Bonus points if you have: * Post-secondary education in a relevant field, such as compliance, information security, computer science, or engineering, or equivalent hands-on experience * A background in software engineering or QA/QC * Experience with AI governance, or a genuine interest in the privacy and data questions that come with AI features * Experience working inside a software or SaaS company Compensation and benefits: * Employee Stock Ownership Plan (ESOP) * Full medical, dental, and vision coverage * Life insurance and disability insurance * Health spending account * Flexible working hours * On-the-job training and growth opportunities * Free on-site parking \n $80,000 - $90,000 a year Salary ranges are based on experience, reflecting the unique skillset each individual brings to the role. \n About BIS: BIS Safety Software has been headquartered in Sherwood Park, Alberta, since 2006. We build software that helps organizations manage safety training, learning, and compliance - and we’re growing! A few things that make us different: we don’t use job titles internally - we value humility and contribution over hierarchy. We move fast, integrate new ideas quickly, and give people real ownership of their work. And through our Employee Stock Ownership Plan (ESOP), you have the opportunity to own a piece of the company you’re helping build. How to apply: Visit our Careers Page [http://www.bissafety.ca/careers] for more information. We sincerely thank all applicants for their interest. Only those selected for interviews will be contacted. Job ID #T202609-03CRC

Ce que vous ferez

The analyst will conduct risk assessments for new software features and ensure ongoing compliance with frameworks like SOC 2, PCI DSS, and GDPR. They will work closely with product and technology teams to verify software behavior and maintain audit readiness throughout the development lifecycle.

Exigences

Candidates should have a background in risk, compliance, privacy, or information security with familiarity in relevant control frameworks. Strong technical aptitude and experience working within project management tools are required to effectively monitor data movement and system integrity.

Avantages

• Employee Stock Ownership Plan • Medical coverage • Dental coverage • Vision coverage • Life insurance • Disability insurance • Health spending account • Flexible working hours • On-the-job training • Free on-site parking

Compétences indiquées

• Technical Documentation · Souhaitée
• Assurance qualité · Souhaitée
• Compliance · Souhaitée
• Communication · Souhaitée
• Gestion de projet · Souhaitée

Autres compétences pertinentes

Relevées dans la description du poste. Confirmez les exigences importantes ci-dessus.

• Risk assessment
• Compliance
• Data governance
• Information security
• SOC 2
• PCI DSS
• GDPR
• ISO 27001
• Software auditing
• Technical documentation
• Project management
• Data privacy
• Quality assurance
• Software development lifecycle
• Analytical thinking
• Communication
• General Data Protection Regulation (GDPR)
• Curiosity
• Self-Discipline
• Artificial Intelligence
• Auditing
• Software As A Service (SaaS)
• Computer Science
• Data Governance
• Data Integrity
• Governance
• ISO/IEC 27001
• Project Management
• Payment Card Industry (PCI) Data Security Standards
• Product Planning
• Control Framework
• Reviewing Applications
• Risk Analysis
• Safety Training
• Software Engineering
• Quality Control
• Technical Acumen
• Detail Oriented

Domaines d’emploi

• Software
• Security & Safety
• Technology
• Legal
• Data & Analytics
• Risk and Compliance Analyst
• Technical Consultant / Analyst
• Systems Analysts
• Computer Occupations, All Other