Privacy Risk Specialist

**Aviso**:
**The Opportunity**:
Reporting to Director, Privacy, the Privacy Risk Specialist will help enhance Aviso's data privacy framework and implement privacy strategies and processes to support Aviso's Legal & Privacy Department and other members of the Company as required. The Privacy Risk Specialist will implement industry best practices and solutions to reduce risk and ensure the protection of customer data. The Privacy Risk Specialist will leverage their knowledge of privacy law, regulations and best practices to assist with privacy inquiries from all departments of the organization and will act as an initial point of contact and lead for the management of all Privacy Impact Assessments (PIAs).

**Who you are**:

- **Service** - You put your clients’ needs first. You advocate service excellence, and work to deliver client-centric solutions, and proactively develop strategic partnerships that allow Aviso Wealth to become a trusted advisor and partner
- **Execution** - You are committed to achieving your goals and to succeed. This includes focusing on “getting things done”, as well as recognizing and taking advantage of opportunities as they arise. You are consistently looking for ways to improve your personal best and see value in continuous improvement. You take accountability for your actions and learn from mistakes
- **Collaboration** - You work collaboratively with others with the common goal of driving positive results. Making meaningful contributions to your team to achieve organizational goals is a priority. You proactively encourage collaboration, build trust and inclusion, and work to establish effective relationships both inside and outside of the organization

**What your day looks like**:

- Privacy Program Leadership_
- Seasoned SME to serve as the central point of contact for all privacy-related projects, vendor engagements, new system integrations, and AI-related inquiries
- Lead the development and implementation of Aviso’s privacy management framework, including tools, policies, processes, and training
- Promote a culture of privacy awareness and provide expert guidance across the organization
- Assessment & Compliance_
- Conduct complex and technical Privacy Impact Assessments (PIAs), Transfer Impact Assessments (TIAs), AI Assessments, and Privacy Compliance Audits, while also performing privacy risk and vendor assessments. These activities embed Privacy by Design and Default principles into products and services to ensure robust privacy compliance and risk mitigation
- Create and maintain processes for TIAs and ensure alignment with cross-jurisdictional data processing requirements
- Monitor and interpret emerging privacy legislation and AI governance standards to ensure proactive compliance
- Governance & Oversight_
- Collaborate with internal stakeholders to maintain records of processing activities and ensure data lifecycle compliance
- Evaluate vulnerabilities identified through PIAs, TIAs or AI Assessments and lead the implementation of corrective actions
- Communicate emerging privacy risks and manage consistency of practices across business units
- Conduct systematic audits to identify areas for improvement and non-compliance
- Reporting & Metrics_
- Develop and track KPIs/KRIs related to privacy assessments and program performance
- Present regular reports and insights to executives and governance committees when applicable
- Maintain logs of outstanding remediation plans and ensure timely updates from initiative owners
- Stakeholder Engagement_
- Work closely with business units, IT, legal, and external regulators to uphold privacy governance
- Provide privacy consultation and support during system development, procurement, and modernization initiatives
- Ensure timely identification and resolution of privacy risks without impacting project timelines

**Requirements**:
**Your experience and skills**:

- **Privacy Impact Assessment Expertise**: Minimum 3 -5 years of experience conducting PIAs for medium to high complexity projects, including both cloud-based and on-premise environments
- **Operational Privacy Experience**: At least 5 years of hands-on operational privacy experience in a corporate or financial industry setting
- **Privacy Requirements Drafting**: 5+ years of experience drafting and reviewing privacy requirements for data sharing agreements
- **Legislative Knowledge**: Deep understanding and practical implementation of Canadian privacy legislation, including PIPEDA, provincial laws (e.g., BC/AB PIPA, Quebec’s Law 25), CASL, FISA 702, EO 12333, OECD Privacy Principles, and other emerging privacy and AI regulations
- **Information Security Acumen**: Strong grasp of technical and information security concepts relevant to privacy risk assessment
- **Reporting & Issue Management**: Skilled in preparing and communicating PIA findings to business units, tracking outstanding issues, and coordinating with project teams for resolution
- **Privacy Control Optimization*