Security & Compliance Manager

PACT is a General Partnership of Alberici, Amico, Kenaidan and Obayashi delivering the Toronto Pearson Accelerator program. The Manager, Security & Compliance owns PACT's information security programme, combining ownership with hands-on execution: the role personally operates controls, collects evidence, authors policy and works in the Microsoft 365 tenant, and carries no direct reports. The role owns the ISO/IEC 27001:2022 certification initiative targeted at Q1 2027 and the parallel SOC 2 Type 2 initiative, run as one control programme with two reporting outputs, and contributes to security architecture and strategy through input into platform security standards and the multi-year security roadmap.

Because member companies second staff and retain the endpoints they issue, endpoint management, HR and office physical security are not centralized, and control ownership splits across PACT tenant-managed, inherited, shared and client-owned scopes.

• Own the ISO/IEC 27001:2022 certification initiative to the Q1 2027 target and the SOC 2 Type 2 initiative
• Run both as one control programme with two reporting outputs, sharing roughly 75-80 percent of control intent
• Author, approve, publish, version-control and maintain the information security policy suite, retaining acknowledgement records
• Author and maintain the Statement of Applicability across the applicable control set, justifying inclusion, exclusion and inheritance
• Operate the document-control procedure, competence matrix, improvement log and corrective-action register in a governed SharePoint library
• Represent certification and attestation status accurately in internal, member-company, client and external communications
• Report status to the IT Steering Committee and provide input to security budget, tooling spend and vendor selection

• Define a risk methodology covering acceptance criteria, impact and likelihood scales, ownership and treatment options
• Establish and maintain the risk register through formal risk assessment, sustained as a live record
• Produce and track the risk treatment plan, verifying control effectiveness rather than accepting reported completion
• Operate annual and event-triggered reassessment on new SaaS, tenant change, incident, audit finding or joint-venture change
• Maintain the evidence inventory, coordinate the quarterly privileged, guest and application access review cycle, and review logs
• Ensure audit logging and retention across the tenant meet certification and investigative requirements
• Ensure backup and recovery controls are evidenced, covering schedule, immutability, retention and restore testing
• Maintain the information asset register and baseline configuration review, recording drift and approvals

• Maintain the supplier security register and review cadence covering the ICT supply chain and managed service provider
• Review Entra application registrations as privileged suppliers, documenting owner, purpose, permission scope and review date
• Maintain the control-ownership split across PACT tenant-managed, inherited, shared and client-owned scopes
• Collect and refresh member-company attestations for inherited endpoint, AV/EDR, patching, physical security and HR controls
• Coordinate shared controls with member-company IT and security teams, covering classification, awareness and business continuity
• Maintain the joiner, mover and leaver process with each member company, and manage dual member-company and PACT identities

• Provide input into platform security architecture, security standards and the multi-year security roadmap
• Assess new platforms,…