Director, Cybersecurity and IT Risk

Position Title:
Director, Cybersecurity and IT Risk

Position Status: Permanent

Posting Status: Open

Starting Salary: $160,317 - $201,962 per year

Hours of Work
: 36.25 per week

Posting Date: August 18, 2026

Closing Date: September 18, 2026

The Office of the Chief Electoral Officer (Elections Ontario) is an independent, non-partisan office of the Legislative Assembly of Ontario, responsible for administering provincial elections, by-elections, and referenda in Ontario. We are committed to making voting easy and accessible for all electors, while maintaining the integrity, security, and transparency of the electoral process.

The Information Technology and Register Services (ITRS) Cluster of Elections Ontario is seeking a highly motivated and innovative leader to set the strategic direction for cybersecurity and IT risk, provide trusted advice to senior leaders, and translate complex security issues into clear risks, options, and recommendations.

The incumbent will oversee cybersecurity governance, risk management, compliance, security operations, incident response, and election readiness activities, with a strong focus on safeguarding critical systems, sensitive information, and public trust.

Play a critical leadership role in protecting the systems, data, and technology that support Ontario’s electoral process. You will lead the development and delivery of Elections Ontario’s cybersecurity and IT risk program, ensuring the organization is prepared to identify, manage, and respond to evolving cyber threats.

You will lead and support a team of cybersecurity professionals, establish priorities, manage resources, and ensure the team is equipped to deliver effective services during regular operations and periods of heightened election readiness. You will also work closely with internal teams, vendors, public-sector partners, and other electoral agencies to strengthen resilience, coordinate responses, and support continuous improvement.

• Developing and operationalizing a multi-year cybersecurity and IT risk strategy aligned with organizational priorities and election readiness needs.
• Advising the CIO and senior leaders on cyber risk posture, emerging threats, investment priorities, and mitigation strategies.
• Leading cybersecurity governance, risk frameworks, policies, standards, procedures, and compliance activities.
• Overseeing security operations, including threat monitoring, detection, escalation, response, recovery, and post-incident review.
• Acting as a senior lead during significant cybersecurity incidents and coordinating response activities across internal teams, vendors, and external partners.
• Leading cyber and IT risk assessments, mitigation planning, monitoring, and reporting using recognized frameworks such as NIST, ISO, and CIS.
• Ensuring cybersecurity practices support legislative, privacy, and data protection requirements related to electoral and financial information.
• Planning and leading cybersecurity readiness activities for election events, including testing, simulations, threat risk assessments, and continuity planning.
• Providing cybersecurity oversight for technology initiatives, cloud services, applications, infrastructure, and identity and access management.
• Managing cybersecurity projects, procurement activities, vendor relationships, contracts, budgets, and resources.
• Building strong relationships across Elections Ontario, government, industry, vendors, and other electoral agencies to support coordination, knowledge sharing, and resilience.

• Demonstrated progressively responsible experience in cybersecurity, IT security, IT risk, or a related field, including leadership experience managing teams, programs, priorities, and resources.
• Demonstrated experience developing and delivering cybersecurity strategies, roadmaps, governance models, and large-scale security initiatives.
• Strong knowledge of cybersecurity governance, risk management, compliance, and recognized frameworks such as NIST, ISO/IEC 27001, CIS Controls, COBIT, or related methodologies.
• Experience overseeing cybersecurity operations, including threat and vulnerability management, security monitoring, incident response, escalation protocols, and recovery activities.
• Knowledge of secure technology architecture and controls across infrastructure, cloud services, applications, identity and access management, and data protection.
• Experience translating complex cybersecurity and IT risk issues into clear advice, recommendations, and decision-support materials for senior leaders and non-technical audiences.
• Demonstrated experience developing and governing AI security and risk management frameworks that enable responsible innovation while safeguarding sensitive information, maintaining public trust, and protecting election integrity
• Knowledge of applicable legislation, privacy obligations, confidentiality…