Senior Compliance Security Specialist

## Senior Compliance Security Specialist Apply locations:
Oakville, ONtime type:
Full time posted on:
Posted Todaytime left to apply:
End Date:
July 18, 2026 (11 days left to apply) job requisition :
JR154272

The Information and Cyber Security Governance (IRGS) function is a dedicated team responsible for effectively managing and controlling information and cyber security within an organization. They develop and maintain policies, standards, and procedures/guidelines/process documents related to information and cyber security. The team identifies, assesses, and manages cyber risks, performs risk assessments, and reports on the organization's cyber risk profile. They promote a strong cyber risk and information security culture throughout the organization.

Additionally, the IRGS team conducts vendor assessments, reviews hardware and software for security gaps, remediates deficiencies, and tests control effectiveness. They build partnerships with stakeholders across the organization, implement self-assessment processes incorporating risk and controls assessment in day-to-day activities, and contribute to adopting state-of-the-art tools and techniques. The team also escalates significant cyber-related issues or observed non-compliance or unethical behavior.

It's important to note that the IRGS team reports directly to the Chief Information Security Officer (CISO) of CTB, who oversees the organization's overall information and cyber security strategy. This reporting relationship ensures alignment with strategic goals and facilitates effective coordination, collaboration, and decision-making between the IRGS function and other areas of the  summary, the IRGS function plays a vital role in governing and managing information and cyber security to protect the organization's assets, data, and systems from potential threats while maintaining a direct line of communication with senior leadership through its reporting structure to the CISO.

** What you’ll do
** The Specialist is a key player responsible for spearheading initiatives to identify, investigate, communicate, resolve, and improve information security governance, risk and compliance in our IT investments.  You will partner with across the organization, including, Technology, Enterprise Risk Management, Internal Audit, PCI Compliance, Vendor Management and other stakeholders to assess cybersecurity risks for the organization, including 3rd party risk, while helping teams determine mitigation strategies to maintain and/or reduce the residual risk of the organization.
* Be the champion in risk assessment of technologies and processes in the environment, including our digital crown jewels and other compliance impacting technologies and processes.
* Connect the dots to improve and enhance risk assessment processes.
* Understand and collaborate with stakeholders for prioritizing and mitigating vulnerabilities identified within the environment through vulnerability assessment, penetration testing, application security testing and/or any other risk assessment activity.
* Following up on vulnerabilities, configuration and cloud gaps and track remediation
* Help further mature existing vulnerability management program
* Assess third-party risk on the use of vendors for day-to-day operations.
* Provide oversight, reporting, and metrics on risk functions.
* Performing security risk assessments for various projects and changes. And assisting with and documenting identified risk for presentation and approval from business and leadership as appropriate.
* Anticipate risk and assist owners in building action plans for risk mitigation.
* Review risk assessments of non-senior team members and peers
* Validating operating effectiveness of IT general controls
* Maintaining risk and controls repositories and documentation
* Providing support for policy exception management procedures
* Assisting with metrics and reporting
* Manage platforms/applications within the mandate of the team
** What you bring
*** University degree or college diploma in technology.
* Possess one or more professional certifications, such as CISSP, CISM, CISA, CCSP, CRISC etc.
* Up to 5+ years of experience in…