Sr. Cybersecurity Analyst/Security Specialist

We are seeking a highly accomplished Sr. Cybersecurity Analyst (Security Specialist) for an enterprise-level contract opportunity based in Toronto. In this role, you will take on a premier strategic capacity within cybersecurity governance, risk management, and regulatory compliance streams, specializing in identifying vulnerabilities, evaluating security architectures, and enforcing enterprise risk controls.

As a principal GRC specialist, you will bridge the gap between technical infrastructure, privacy legislation, and enterprise security frameworks. Operating within a hybrid work model, you will lead comprehensive security and privacy impact assessments (PIAs/TRAs), develop and refresh corporate cybersecurity policies, manage third-party vendor risk programs, and ensure strict alignment with industry security standards and Canadian privacy regulations. This position is tailored for a certified security authority (CISSP or CRISC) who can deliver actionable risk analytics, evaluate third-party vendor contracts, and govern compliance across IT, cloud, and operational technology (OT) environments.

Location: Toronto, ON

Assignment Type: Hybrid (2 to 3 days per week onsite)

Contract Duration: 24-month contract (with potential for 1-year extension)

Advantages

• High-Impact Risk Leadership: Drive enterprise-wide Security Risk Assessments, Privacy Impact Assessments (PIAs), and Threat and Risk Assessments (TRAs).
• Broad Framework Exposure: Govern compliance across leading standards including NIST CSF, ISO/IEC 27001/27002, ISA/IEC 62443, NERC CIP, CIS Controls, and SOC2.
• Complex Multi-Environment Scope: Evaluate risk profiles across enterprise IT, cloud platforms, hybrid networks, and industrial/OT infrastructure.
• Long-Term Enterprise Engagement: Secure a foundational multi-year contract runway with potential for further extension.

Responsibilities

• Conduct comprehensive security and privacy risk assessments across new and existing information systems, network infrastructure, cloud environments, and operational technologies.
• Analyze existing security controls, perform vulnerability evaluations, and assess technical architectures to identify threats and operational risks.
• Formulate, document, and recommend actionable security controls to mitigate identified risks and communicate findings effectively to technical and business stakeholders.
• Identify, assess, and monitor cybersecurity and privacy risks, providing predictive analytics to support strategic business decisions.
• Develop, refresh, enhance, and communicate enterprise cybersecurity governance frameworks, policies, standards, and operational procedures.
• Design technical, administrative, and physical security controls to ensure organizational compliance with Canadian privacy and cyber security legislation (PHIPA, MFIPPA, CASL, CCSPA).
• Execute periodic gap assessments across the information security program, validate ongoing control compliance, facilitate remediation plans, and elevate critical issues to leadership.
• Manage the security exception review and approval lifecycle, ensuring all risk acceptances are documented and re-evaluated on a defined schedule.
• Perform initial and ongoing third-party vendor security due diligence, vendor risk monitoring, and maintain the enterprise supplier risk inventory.
• Review information security and privacy clauses within procurement documents (RFIs, RFPs, MPSAs, contracts, and purchase orders) to identify gaps and enforce data protection terms.
• Provide expert GRC advisory services across enterprise projects, IT initiatives, and technology modernization programs.

Qualifications

Core Requirements & Mandatory Certifications

• Education: University degree in Computer Science, Information Security, Cybersecurity, or a related field (or an equivalent combination of education and professional experience).
• Mandatory Professional Certification: Active credential in at least one of the following:
  • Certified Information Systems Security Professional (CISSP)
  • Certified in Risk and Information Systems Control (CRISC)
• GRC Experience: 7+ years of relevant cybersecurity experience focused on Governance, Risk, and Compliance (GRC).
• Privacy Impact Assessments: 5+ years of hands-on experience conducting Privacy Risk Assessments and Privacy Impact Assessments (PIAs).
• Enterprise IT Experience: 10+ years of progressive Information Technology experience.
• Security Framework Depth: Significant experience applying enterprise security frameworks and standards, such as NIST CSF, ISO/IEC 27001/27002, ISA/IEC 62443, NERC CIP, CIS Controls, and SOC2.
• Policy & Governance Development: Demonstrated experience developing, refreshing, and implementing cybersecurity policies, standards, guidel