Director, Risk & Compliance

We are seeking an experienced and strategic leader to lead the Risk & Compliance team and act as the Privacy Officer and Data Protection Lead for GWLRA. In this role, you will oversee and enhance GWLRA’s risk management and compliance frameworks and processes, ensuring alignment with business objectives, regulatory requirements, and best practices. This position requires a balance of technical experience, strategic vision, and interpersonal skills to build partnerships across business units while fostering a culture of accountability and compliance.

14-Month Temporary Contract

RESPONSIBILITIES

Stakeholder Relationship Management

• Serve as the primary liaison between business units, ensuring an alignment between business needs and compliance requirements.
• Develop and maintain strong communication channels with internal and external stakeholders.
• Escalate issues when necessary, advocating for practical solutions that balance business enablement and risk mitigation.

Compliance Oversight & Reporting

• Complete quarterly compliance reporting.

Risk Management Oversight & Reporting

• Chair of the Risk Oversight Committee. Lead the business units in identifying, categorizing, prioritizing, and documenting risks.

Third Party Risk Management & Vendor Due Diligence

• Oversee the third-party risk management and vendor due diligence process.
• Conduct analysis of the assessments of vendors, document identified risks and present them to the business.
• Collaborate with the Procurement team to integrate compliance requirements into vendor management workflows.

Privacy

• Acting Privacy Officer & Data Protection Lead, serving as the subject matter expert on privacy legislation and best practices.
• Lead efforts to mature and maintain the privacy program, leveraging work completed on the Quebec Law 25 project to a national scope.
• Lead the breach management process for privacy incidents.

Data Governance

• Oversight of retention and disposition program of physical and digital records in collaboration with the data governance teams and in compliance with regulatory and internal policies.
• Support the cyber security program from a digital buildings and enterprise technology perspective.

Accessibility

• Assist in the roll out of the new digital accessibility program, in alignment with legislative requirements and internal standards.

QUALIFICATIONS

• Minimum 5+ years in a risk management, compliance, and/or data protection role, with experience in leadership.
• University or college degree in a relevant field.
• Strong project management and communication skills, with the ability to influence and collaborate across multiple teams and levels.
• Strong analytical and problem-solving abilities with a focus on risk-based decision-making.
• In-depth knowledge of data protection best practices and legislation.
• Relevant certifications (CIPP/C, CIPT) are a strong asset.