Cybersecurity Governance Analyst

Codan (Canada) Inc. (CCI) was created in 2009 and is affiliated with the offshore law firm Conyers, which has offices in Bermuda, Cayman Islands, British Virgin Islands, Hong Kong, Singapore and London.

The Cybersecurity Governance Analyst is responsible for developing, maintaining and continuously improving Conyers' cybersecurity governance and assurance programs.

The role supports the firm's information security management framework, third-party risk management processes, regulatory obligations and client assurance requirements, ensuring that security governance activities remain effective, auditable and aligned with business objectives.

The role combines program development, risk assessment, assurance reporting and stakeholder coordination, supporting the firm's ongoing cybersecurity maturity journey and helping maintain confidence among clients, regulators and internal stakeholders.

What Will You Do

Governance & Security Frameworks

• Support the development, implementation and ongoing maintenance of Conyers' information security governance framework.
• Coordinate governance activities relating to ISO/IEC 27001 management systems.
• Maintain security policies, standards, procedures and supporting documentation.
• Coordinate periodic policy reviews and governance approvals.

Third-Party Risk Management

• Administer the vendor security assessment program.
• Conduct security due diligence reviews of new and existing vendors.
• Track remediation actions arising from vendor assessments.
• Maintain third-party risk registers and reporting metrics.

Risk & Assurance

• Maintain cybersecurity risk registers and treatment plans.
• Coordinate risk assessments and control reviews.
• Support internal and external audits.
• Monitor remediation activities and track progress to completion.
• Produce governance reporting and management dashboards.

Client & Regulatory Assurance

• Coordinate responses to client cybersecurity questionnaires and security due diligence requests.
• Maintain evidence repositories supporting client and regulatory assurance activities.
• Assist with regulatory reporting requirements where required.
• Support client audits and assurance reviews.

Program Management

• Track governance initiatives, action plans and remediation activities.
• Maintain governance documentation and audit trails.
• Coordinate governance meetings and follow-up actions.
• Support continuous improvement initiatives across the cybersecurity programme.

What Will You Need

• 3–5 years' experience in information security governance, risk management, compliance, audit, or cybersecurity assurance.
• Practical experience supporting and maintaining an Information Security Management System (ISMS), preferably aligned to ISO/IEC 27001.
• Experience conducting vendor and third-party security risk assessments and managing remediation activities.
• Experience responding to client security questionnaires, audit requests, or regulatory information requests.
• Very strong written communication and documentation skills, with the ability to produce policies, procedures, risk assessments, reports, and governance documentation.
• Ability to translate technical security concepts and controls into clear, business-focused language for non-technical stakeholders.
• Strong organisational and project coordination skills, with the ability to manage multiple governance and assurance activities simultaneously.
• Experience maintaining risk registers, tracking actions, and supporting audit or compliance reviews.

Desirable

• Experience supporting ISO/IEC 27001, NIST CSF, and similar governance frameworks.
• Experience within a professional services, legal, financial services, or regulated environment.
• Familiarity with AI governance, data protection, privacy, or cloud security governance.
• Relevant certifications such as ISO 27001 Lead Implementer, ISO 27001 Lead Auditor, CISA, CRISC, CISSP, Security+, or similar.

Codan (Canada) Inc. is an Equal Opportunity Employer. We will provide accommodations to applicants with disabilities throughout the recruitment, selection and/or assessment process. If selected to participate in the recruitment, selection and/or assessment process, please inform us of the nature of any accommodation(s) that you may require.