Information Security Specialist

**Information Security Specialist**

**Scarborough, Ontario (Hybrid)**

Toyota Canada Inc. (TCI) is the exclusive Canadian distributor of Toyota and Lexus vehicles. Toyota Canada's head office is in Toronto, with regional offices in Vancouver, Calgary, Montreal and Halifax. Toyota parts and accessories are distributed through TCI's Parts Distribution Centres in Bowmanville and Vancouver. TCI supports over 287 Toyota and Lexus dealers in Canada with services that include training, sales, marketing, environmental and customer satisfaction initiatives.

**What Sets Us Apart?**

A focus on People, Passion for Toyota, Innovation and Make Things Better has made us an award-winning company, recognized worldwide for our technological leadership and superior standards of quality, community involvement and environmental responsibility.

**Job Summary**:
Toyota Canada Inc. currently has an exciting opportunity for an Information Security Specialist. This is a full-time role and will report to the Manager, Enterprise Information Security. There are no direct reports to this role. This person will be responsible for providing end-to-end security review of technical solutions at various stages including early architecture, conceptual/logical and physical design phases. This person will also be responsible for completing full blown Threat Risk Assessments (TRA) as well as security reviews of vendors and software products. While the security review is end-to-end in nature, there is no architecture design involved.

**What We’ll Bring**:

- A hybrid work environment
- A work environment built on teamwork, flexibility and respect
- Competitive compensation package including health and dental benefits, and bonus
- Health and dental benefits effective immediately
- Company pension plan with matched contribution
- Associate vehicle discount program
- Professional growth and development programs to help advance your career, as well as tuition reimbursement
- Fitness reimbursement
- Great company culture - Respect for people and continuous improvement is at our core
- Paid holiday shutdown and competitive paid time off benefits
- Summer Hours - condensed work week during the summer
- Sabbatical Leave Program

**What You’ll Be Doing**:

- Provides end-to-end security architecture review to projects
- Assist with assessment and integration of cloud vendors and SaaS from an Information Security requirements perspective
- Complete vendor security assessments and software/product security assessments
- Lead pen test activities (internal or external)
- Assist the Enterprise Solution Architect in designing a secure and stable solution with the best possible risk posture
- Complete security assessments and TRAs for projects, identify security gaps/vulnerabilities and provide precise actionable remediation options for the solution team
- Participate in POC/POT/whiteboarding design sessions/vendor selection and assessment process and discovery/early architecture sessions
- Collaborate with Solution Architects, Enterprise Solution Architects and technical resources
- Ensure solution alignment to security policies, best practices and global Toyota security requirements
- Build security playbooks and checklists for varying solution types like infrastructure upgrades, laptop refreshes, cloud solutions, COTS solutions etc.
- Provide guidance and oversight to 3rd party vendors to ensure technology solutions meet TCI standards
- Support the creation of RFI/RFQ/RFP/SOW/A3 documents
- Participate/assist manager with security audit requirements
- Assist in conducting Security Training & Awareness
- Identify opportunities to implement Data encryption
- Establish and maintain strong relationship with IS teams at other Toyota affiliates to identify opportunities to leverage common technology
- Review security access methods and compliance to TCI and TCCI audit requirements
- Other projects as assigned

**What You’ll Bring**:

- University Degree in Computer Science, Engineering or Business or relevant experience in information security and security architecture
- Wholesale, retail, automotive or manufacturing industry experience would be an asset
- 8+ years of progressive experience in the information security
- Minimum 3 years of experience in writing security assessments/TRA (several enterprise-wide solutions), vendor security assessments, software security assessments
- Strong experience with cloud platforms, SaaS/PaaS/IaaS. Cloud and hybrid cloud security expertise is a MUST (AWS is a plus)
- CISSP certification is a MUST, cloud security certification, ITIL, COBIT are a strong plus
- Excellent understanding of various enterprise tools (ERP, CRM, WHS, HCM), database, infrastructure, integration/middleware technologies, 3-tier architectures, mainframe environment and HA environments
- Excellent understanding of SDLC and solution design and delivery process
- Knowledge of secure access modelling, threat modelling, digital security methodologies