Senior Business Analyst, Security Remediation

Canada - Toronto · CAD 118,000-152,000 · 7+ years experience · Posted Oct 19, 2026

At a glance

At Capco, we are looking for an experienced Business Analyst, Security Remediation to support enterprise-wide technology risk, security remediation, and governance initiatives within the banking and payments sector.
You will play a key role in coordinating cloud hardening and security remediation activities, managing audit and regulatory commitments, and ensuring remediation outcomes are measurable, traceable, and supported by robust evidence.
Working closely with Information Security, Cloud Engineering, Technology Risk, Compliance, Audit, and business stakeholders, you will help translate complex security and control requirements into actionable remediation plans.

Coordinate cloud security hardening initiatives, track remediation of security vulnerabilities and control gaps, and work with Cloud Engineering and Information Security teams to ensure remediation activities align with enterprise security standards and risk requirements.
Develop and maintain enterprise remediation plans, milestone schedules, management action plans, risk and issue registers, dependency trackers, and commitment logs supporting internal audits, regulatory reviews, and technology risk programs.
Oversee evidence collection, quality reviews, approvals, and submission processes, ensuring remediation outcomes are appropriately documented, traceable, and ready for audit, risk, compliance, or regulatory assessment.
Produce dashboards, scorecards, governance presentations, and concise executive updates highlighting remediation progress, cloud security risks, milestone performance, blockers, and decisions requiring escalation.
Facilitate cross-functional governance forums, maintain RACI models, process documentation, and decision records, and support consistent ownership, escalation, and closure-readiness practices across remediation workstreams.

7+ years of relevant experience in business analysis, technology governance, security remediation, risk management, audit support, regulatory compliance, or enterprise remediation programs, ideally within complex financial services environments.
Demonstrable hands-on experience supporting cloud hardening and cloud security remediation initiatives, including coordinating security control improvements, tracking vulnerabilities or configuration weaknesses, managing remediation milestones, and validating evidence of completed remediation.
Proven experience managing audit findings, regulatory commitments, control deficiencies, management action plans, evidence repositories, and closure-readiness activities, with a strong understanding of issue management, control ownership, and evidence traceability.
Strong analytical, facilitation, documentation, and communication skills, with experience translating complex technology and security requirements into actionable plans, managing multiple workstreams, resolving dependencies, and preparing executive-level reporting.
Advanced proficiency with Microsoft Excel, PowerPoint, Word, Teams, and SharePoint, combined with the ability to maintain accurate governance documentation, manage competing priorities, and escalate delivery risks appropriately.

Experience within banking, payments, or other highly regulated financial services environments, including regulatory examinations, audit remediation, MRA programs, and enterprise technology risk initiatives.
Familiarity with cloud security, infrastructure security, identity and access management, data protection, application security, and operational risk controls.
Working knowledge of security and governance frameworks such as NIST, ISO/IEC 27001, CIS Controls, COBIT, or comparable enterprise risk and control frameworks.
Experience using Jira, Confluence, ServiceNow, Archer, Azure DevOps, Power BI, or comparable workflow, governance, evidence-management, and reporting platforms.
Relevant professional certifications such as CBAP, PMI-PBA, PMP, CISA, CRISC, or equivalent qualifications.

Comprehensive Benefits Coverage: 100% company-paid health, life, and disability insurance effective from Day 1 of employment.
Retirement Savings Program: Registered Retirement Savings Plan (RRSP) with the option of receiving a matching employer contribution.
Virtual Health Care: Company-paid program available to all employees and their dependents/partners.
Employee & Family Assistance Program (EFAP): Company-paid support services for employees and their dependents/partners.
Parental Leave Top-Up: Enhanced parental leave benefits available from Day 1 of employment.
New Parent Gift: A company-sponsored gift to celebrate the arrival of a new child.
Wellness Support: Fitness reimbursement benefit to promote health and well-being.