Senior Business Analyst, Security Remediation

At Capco, we're looking for an experienced Business Analyst, Security Remediation to support enterprise-wide technology risk, security remediation, and governance initiatives within the banking and payments sector. You'll play a key role in coordinating cloud hardening and security remediation activities, managing audit and regulatory commitments, and ensuring remediation outcomes are measurable, traceable, and supported by robust evidence. Working closely with Information Security, Cloud Engineering, Technology Risk, Compliance, Audit, and business stakeholders, you'll help translate complex security and control requirements into actionable remediation plans, strengthen accountability, and provide clear reporting to senior leadership. This role requires hands-on experience supporting cloud hardening initiatives and security remediation programs, alongside strong business analysis, governance, stakeholder coordination, and delivery management capabilities.

Responsibilities

Drive cloud hardening and security remediation: coordinate cloud security hardening initiatives, track remediation of security vulnerabilities and control gaps, and work with Cloud Engineering and Information Security teams to ensure remediation activities align with enterprise security standards and risk requirements; Manage remediation governance: develop and maintain enterprise remediation plans, milestone schedules, management action plans, risk and issue registers, dependency trackers, and commitment logs supporting internal audits, regulatory reviews, and technology risk programs; Coordinate evidence and audit readiness: oversee evidence collection, quality reviews, approvals, and submission processes, ensuring remediation outcomes are appropriately documented, traceable, and ready for audit, risk, compliance, or regulatory assessment; Deliver executive reporting and insights: produce dashboards, scorecards, governance presentations, and concise executive updates highlighting remediation progress, cloud security risks, milestone performance, blockers, and decisions requiring escalation; Strengthen controls and stakeholder accountability: facilitate cross-functional governance forums, maintain RACI models, process documentation, and decision records, and support consistent ownership, escalation, and closure-readiness practices across remediation workstreams

Requirements

7+ years of relevant experience in business analysis, technology governance, security remediation, risk management, audit support, regulatory compliance, or enterprise remediation programs, ideally within complex financial services environments; Mandatory cloud hardening experience: demonstrable hands-on experience supporting cloud hardening and cloud security remediation initiatives, including coordinating security control improvements, tracking vulnerabilities or configuration weaknesses, managing remediation milestones, and validating evidence of completed remediation; Remediation and control governance expertise: proven experience managing audit findings, regulatory commitments, control deficiencies, management action plans, evidence repositories, and closure-readiness activities, with a strong understanding of issue management, control ownership, and evidence traceability; Business analysis and stakeholder management: strong analytical, facilitation, documentation, and communication skills, with experience translating complex technology and security requirements into actionable plans, managing multiple workstreams, resolving dependencies, and preparing executive-level reporting; Reporting and collaboration tools: advanced proficiency with Microsoft Excel, PowerPoint, Word, Teams, and SharePoint, combined with the ability to maintain accurate governance documentation, manage competing priorities, and escalate delivery risks appropriately

Nice to have

Experience within banking, payments, or other highly regulated financial services environments, including regulatory examinations, audit remediation, MRA programs, and enterprise technology risk initiatives; Familiarity with cloud security, infrastructure security, identity and access management, data protection, application security, and operational risk controls; Working knowledge of security and governance frameworks such as NIST, ISO/IEC 27001, CIS Controls, COBIT, or comparable enterprise risk and control frameworks; Experience using Jira, Confluence, ServiceNow, Archer, Azure DevOps, Power BI, or comparable workflow, governance, evidence-management, and reporting platforms; Relevant professional certifications such as CBAP, PMI-PBA, PMP, CISA, CRISC, or equivalent qualifications

Benefits

100% company-paid health, life, and disability insurance effective from Day 1 of employment; Registered Retirement Savings Plan (RRSP) with the option of receiving a matching employer contribution; Company-paid virtual health care program available to all employees and their dependents/partners; Company-paid Employee & Family Assistance Program (EFAP); Parental leave top-up available from Day 1 of employment; New parent gift; Fitness reimbursement wellness support; Business coach from Day 1; Possible annual discretionary/variable bonus