Governance, Risk, & Compliance Manager

Governance, Risk & Compliance Manager

About Inovatec

Inovatec is an exciting growth company based in Vancouver, BC, established in 2006. We are North America’s leading provider of cloud-based software solutions for the automotive, motorcycle, powersports, and equipment financing industries. Our solutions are used by some of the largest banks, credit unions, and finance companies in Canada and the U.S.

At Inovatec, we foster a diverse and inclusive environment that encourages collaboration where we grow together and win as a team. It’s important that we live up to our four core values: make sound decisions, get better every day, act like an owner, and we before me. We thrive by challenging the status quo to push the industry forward, and we know when to have fun!

With team members across North America and Europe, we’re committed to investing in the development of our team, no matter where they’re located.

Inovatec is hiring a Governance, Risk & Compliance (GRC) Manager to own the day-to-day execution and continued maturity of our security, privacy, and compliance program. This role is central to our shift from point-in-time audits to continuous, evidence-based control monitoring, anchored in our GRC platform, and to keeping Inovatec audit-ready year-round across various compliance frameworks and providing a high level of assurance to our clients.

You will lead a small, focused team, directly managing our Internal Auditor / GRC Specialist, and the two of you will work shoulder-to-shoulder across all governance, risk, audit, and compliance efforts. You will operationalize governance, run our risk management lifecycle, manage third-party risk, and coordinate internal and external audits. Reporting to the Head of Cybersecurity & Compliance, you will partner closely with Infrastructure, Product Engineering, IT, Legal, Finance, and People & Culture.

We are looking for a candidate ideally based in Ontario, Canada.

Leadership, Management & Accountability (LMA)

• Directly manage the Internal Auditor / GRC Specialist, owning coaching, priorities, development, and day-to-day workload, and partnering closely on every governance, risk, audit, and compliance effort.
• Set clear expectations and a steady operating cadence (1:1s, planning, quarterly goals) so audit and compliance work is delivered predictably and to a high standard.
• Champion intent-based leadership, growing the autonomy, judgement, and technical depth of your report while ensuring shared coverage and no single points of failure.
• Serve as a hands-on working manager who leads by doing, shares the workload, and steps into complex assessments and audits alongside your report.

• Own and continuously mature Inovatec’s GRC program across frameworks like SOC 1 & SOC 2 Type II, ISO 27001, ISO 27018 and TISAX.
• Drive the transition from point-in-time audits to ongoing control monitoring, completing migration of GRC processes into the GRC platform and maintaining ≥90% of controls under continuous monitoring.
• Automate evidence collection across active frameworks (targeting ≥80% reduction in manual evidence) and maintain a real-time compliance posture dashboard.
• Manage the policy lifecycle, covering authoring, review cadence, versioning, and employee policy acknowledgment (≥95% target).
• Own and mature the privacy, compliance, and security awareness training program, ensuring it remains aligned to company policies, client obligations, and applicable compliance frameworks.
• Support AI compliance readiness, including CSA AI validation and ISO 42001 (AI Management System) compliance.

• Operate the enterprise risk lifecycle (identification, scoring, categorization, treatment, and workflows aligned to Inovatec’s approved risk policies), with monthly risk snapshots for historical tracking and audit-ready reporting.
• Maintain the risk register and support quarterly compliance health reviews and board-level risk reporting.
• Track remediation against SLAs (e.g.,