Information Security Specialist - CISA, GRCLocation: Toronto, ON
Onsite FlexibilityHybrid - currently 2 days/week in office, with potential to increase to 4 days
Contract Details- Position Type: Contract
- Contract Duration: 6 months (extension possible)
- Pay Rate: C$86.00–C$103.00 / Hour (CAD)
- Shift / Schedule: Monday–Friday, 9:00 AM – 5:00 PM
- Travel Requirements: Not required
Job SummaryThis is a senior information security governance, risk, and compliance (GRC) role within a leading financial institution's Global Security & Defense team - a group of highly valued professionals who support all Global Technology Solutions-related regulatory and audit interactions, including business, 2nd, and 3rd line-of-defense (LOD) led exams. The team provides oversight and governance, independently challenging high- and medium-severity issues tied to regulatory, audit, and operational risk management (ORM), including issue escalations tied to potential overdue and validation failures, issue support for insight, governance reporting, and exams, as well as demand management support and assurance functions. We are looking for someone who is well-versed at providing governance, risk, compliance, and issue remediation oversight and control best practices that meet the organization's overarching Global Technology Solutions strategy and objectives. The individual will be responsible for partnering with Technology segments to support independent challenge and oversight of issue remediation plans impacting the information security control environment.
Key Responsibilities- Lead assessments of audit and regulatory finding remediations required to mitigate risk within technology infrastructure and applications, working with stakeholders across the three lines of defense to ensure effective risk mitigation and remediation
- Provide advice and guidance to Technology segments and Technology Risk Services on various areas requiring subject matter expertise and interpretation: Audit & Assurance Standards; IT Risk Governance Control Frameworks; and GRC (Governance, Risk, and Compliance) frameworks
- Contribute to the development of mature Governance Oversight & Control practices, through improvement of Risk Identification, Control Design and Operating Effectiveness
- Identify emerging themes, understand trends, and provide specialized business management advice to senior management and respective teams while raising industry, external and internal, enterprise and business awareness
- Lead continuous improvement projects, leveraging agile/lean continuous improvement practices/methods that demonstrate sustainable and leading-edge solutions (e.g., Artificial Intelligence (AI), Machine Learning (ML), Power BI/Apps, Python, etc.)
- Strengthen the independent assurance, governance and oversight operations, utilizing lean continuous improvement practices and tools
- Apply core Agile frameworks (e.g., Scrum, Kanban) to execute operational workplan projects
- Collaborate with data scientists, engineers, information security specialists, and business stakeholders to align AI initiatives with strategic objectives
- Ability to train colleagues and team members related to risk and compliance of issue remediations
- Manage multiple efforts simultaneously, priority demands and strong organizational skill
- Effectively interact with individuals across the organization and at various levels (technical, business, Senior & Executive Management)
- Stay current with the latest research and trends in AI/ML and recommend relevant tools, frameworks and methodologies
- Perform sample-based testing using IOR methodology (Inspection, Observation, Reperformance); assess design effectiveness, implementation, operational effectiveness and sustainability; trace testing back to evidence
- Perform end-to-end QA of remediation plans; determine whether remediation is complete, risk-aligned, sufficiently evidenced and validation-ready; assess root cause, risk reduction, design/operating effectiveness and sustainability; produce testing scripts, results, QA rubric and close-out memo
- Lead risk-focused reviews and challenge meetings; challenge issue owners and remediation teams using testing/QA results; work across 1st, 2nd and 3rd lines of defense; interact with senior stakeholders including VP/SVP/EVP-level stakeholders
- Identify common themes across different findings/segments that could indicate a systemic or enterprise-wide issue and escalate those themes to senior leadership
- Participate in continuous improvement, including using AI and other tools to improve QA/testing efficiency
Must-Have Requirements- IT audit - IT Governance Controls and Standards – 10 years
- Quality assurance as it relates to remediation plans – 10 years
- Very strong comms – written and verbal- key
- IT governance experience in information security and controls risk frameworks – 10 Years
- Experience with assessing evaluation of audit and regulatory remediation – 10 years
- governance frameworks
- Team player – collaborate well with other team members
- Knowledge and experience with various technology tools including, but not limited to, RSA Archer, JIRA, Confluence, Sharepoint, MS Office, Excel. SERVICENOW
- IOR methodology OR comparable audit validation approaches.
- Strong auditor mindset
- Experience developing sample based test plans – 10 years
- CISA certification
Required Skills- Expert knowledge of IT Audit and Control methodology, IT Governance Controls and Standards, and associated tools to ascertain the quality and effectiveness of technology remediation plans
- Competencies in technology controls, emerging threats, and technology risk disciplines and practices
- IT governance experience in information security and controls risk frameworks (i.e., ITIL, NIST, COBIT)
- Knowledge and experience with various lifecycle methodologies/frameworks, i.e., Agile, Project Management, IT Processes, Risk Management frameworks and process/operations
- Knowledge and experience with various technology tools including, but not limited to, RSA Archer, JIRA, Confluence, SharePoint, MS Office, Excel, and ServiceNow
- Excellent verbal and written business communication skills; meticulous documentation
- Attention to detail
- Information Security or technology risk and controls background (financial industry experience a plus)
Preferred Skills- CISSP certification or equivalent experience
- Financial industry/banking experience
Required Experience- 10 years as an IT Risk Specialist with relevant experience in governance, risk and compliance management within regulated industries
- Experience developing sample-based test plans and performing end-to-end QA of remediation plans
- Experience with IOR methodology (Inspection, Observation, Reperformance) or comparable audit validation approaches
- Experience assessing and evaluating audit and regulatory remediation
- Experience leading risk-focused reviews, challenging remediation owners, and interacting with VP/SVP/EVP-level stakeholders
Education Requirements- University degree in a relevant field, or equivalent experience
- CRISC certification or equivalent experience required
- CISSP certification or equivalent experience (a plus)
Work Environment / Physical Requirements- Role involves access to customer data and regulatory/compliance considerations
- Hybrid work schedule - currently 2 days/week in office in Mississauga, with potential to increase to 4 days
- No overtime required
- No rotation
- Interview process: 1 panel interview (1 hour), covering technical and behavioural questions, conducted virtually
About the ClientThis client is a leading Canadian financial institution operating across global markets, with a large technology and security division that supports regulatory, audit, and risk management functions across multiple lines of defense. The organization employs thousands of professionals spanning information security specialists, IT risk and governance experts, technology engineers, data scientists, compliance professionals, and business analysts who collaborate across agile, cross-functional teams to protect one of North America's largest banking ecosystems.
About GTTGTT is an NMSDC-certified Minority Business Enterprise (MBE) headquartered in Portsmouth, New Hampshire. GTT is a subsidiary of Chenega Corporation, an Alaska-based company and one of the largest Alaska Native-owned corporations. An Inc. 5000 honoree and one of SIA's Best Staffing Firms to Work For, GTT connects professionals with Fortune 500 organizations across IT, engineering, construction, utilities, life sciences, financial services, and healthcare throughout the U.S. and Canada. We're committed to diverse, inclusive workplaces and to placing people in roles where they can do their best work.
Job Number: 26-10988
#gttca
