GRC Specialist

Miovision is looking for a GRC Specialist to sit within the Office of Cybersecurity and operationalize the Unified Risk Management Framework, ensuring products, cloud platforms, and enterprise systems meet global industry standards. The role focuses on steering risk registers, maintaining audit readiness, and ensuring security enables business growth.

Responsibilities

Identify, assess, and track enterprise, cyber, product, and third-party risks; Maintain risk scoring, treatment plans, and evidence in alignment with ISO 27001, SOC 2, and NIST; Drive risk remediation and manage risk acceptance workflows with executive approvals; Drive day-to-day GRC operations across ISO 27001, SOC 2, and NIST, mapping controls to eliminate duplication; Collect and validate evidence for internal assessments and manage the lifecycle of security policies and standards; Research, recommend, and implement process improvements to streamline compliance efforts; Build audit playbooks and practical controls bridging certification requirements and operational reality; Serve as a key player during external audits, coordinating with internal control owners on evidence submission; Craft responses to customer security questionnaires, RFPs, and due-diligence requests; Partner with Engineering, Cloud Ops, IT, and Product to embed risk considerations into development, operations, and vendor onboarding; Act as a key risk gatekeeper for product releases and major delivery milestones; Drive security awareness training and clear risk communications across the business; Champion security best practices and build a company-wide security culture; Participate in cross-functional risk forums and working groups; Take ownership of key GRC components such as third-party risk or policy governance; Drive process automation and program maturity, leveraging AI tooling securely; Partner with the GRC Manager to support executive reporting and high-level strategic initiatives

Requirements

Experience in GRC, cyber risk, compliance, or information security, ideally within SaaS, cloud, or critical-infrastructure environments; Deep, practical working knowledge of at least three major frameworks (ISO 27001, SOC 2, NIST, FedRAMP, FAIR, or COSO); Ability to explain control gaps to engineers and get them fixed without friction; Proactive self-starter who has independently taught themselves new frameworks, tools, or systems to solve complex problems; Highly proficient with modern GRC platforms, with proven hands-on ability to build and operate risk registers and control frameworks; Effective at using AI to speed up workflows and ensure accuracy, with the judgment to spot when AI is wrong; Valuable exposure to public-sector or highly regulated customers (federal, state, municipal, or transportation agencies) is a plus

Benefits

Comprehensive health benefits from day one; 24/7 virtual healthcare access; Dedicated wellness programs; RRSP/401K Matching Plan; Variable Incentive Plan; Mio-Days and flexible vacation policy; Flexible work options; Internet subsidy; Remote work allowance; Enhanced leave for new parents