Job Description
On behalf of our public sector client, Affinity is seeking a Senior Enterprise Cybersecurity Strategist (vCISO) to be its fractional CISO-level advisor. The role sets the enterprise direction for a growing Cybersecurity Program of about 20 dedicated resources, with active work in cloud security, vulnerability management, data protection, network segmentation and endpoint detection. You will assess where the organization stands against the NIST Cybersecurity Framework, define a realistic target state, and turn that into a prioritized, multi-year roadmap. Leadership needs a clear line from cyber risk to NIST gaps, to initiatives and investment, to measurable maturity improvement.
Responsibilities
What you'll do
NIST maturity assessment
- Lead or independently perform enterprise NIST CSF maturity assessments: stakeholder interviews, evidence review, scoring, gap analysis and recommendations.
- Review and validate the existing assessment, then lead the transition of the maturity program to NIST CSF 2.0.
- Set a repeatable reassessment method and evidence model, and separate "capability implemented" from "control proven effective."
Strategy and roadmap
- Develop and maintain an enterprise cybersecurity strategy aligned to clinical, operational and regulatory priorities.
- Turn findings into a prioritized multi-year roadmap with clear sequencing, dependencies, quick wins and longer-term investments.
- Keep traceability between risks, NIST outcomes, capability gaps, initiatives and investment.
Architecture and technical challenge
- Review security architecture across cloud, on-premises, identity, network, endpoint, data and security operations.
- Challenge proposed designs where they don't address the underlying risk, and spot duplication between initiatives.
- Guide strategy across the Microsoft security stack (Azure, Entra ID, Sentinel, Defender XDR, Defender for Cloud, Purview).
Investment, measurement and governance
- Build a framework for ranking initiatives by risk reduction, maturity gain, readiness, effort and value.
- Define control-effectiveness measures, KPIs and KRIs for program and executive reporting.
- Advise on cyber risk ownership, acceptance and escalation, and support business cases and options analysis.
Executive advisory
- Act as trusted senior advisor to program leadership, and present to steering committees and governance forums.
- Translate cybersecurity issues into clear business, clinical and risk language, and build alignment across IT, Privacy, Risk and Procurement.
Key deliverables
Priorities and sequencing will be agreed with program leadership at the start of the engagement.
- Enterprise cybersecurity maturity assessment and current-state baseline
- NIST CSF 2.0 assessment and transition approach
- Target-state maturity model and capability target state
- NIST gap and capability mapping, with risk-to-NIST traceability
- Enterprise cybersecurity strategy
- Prioritized initiative portfolio and investment prioritization framework
- Multi-year cybersecurity roadmap
- Control effectiveness and assurance framework
- KPI, KRI and maturity measurement framework
- Periodic maturity reassessment and roadmap refresh
What You Bring (must-haves)
- 15+ years of progressive cybersecurity experience, including significant senior experience in enterprise security strategy, architecture, risk or governance.
- Experience as a CISO, vCISO, Principal or Enterprise Security Architect, Chief Security Advisor or equivalent in a large, complex organization.
- Personally led NIST Cybersecurity Framework assessments, including evidence review, maturity scoring, gap analysis and recommendations.
- Strong practical knowledge of NIST CSF 2.0, including the Govern function.
- Track record of turning assessment findings into an enterprise strategy, prioritized portfolio and multi-year roadmap.
- Broad technical depth across cloud, identity, endpoint, network, applications, data protection, security operations, incident response and vulnerability management, with enough credibility to challenge senior architects.
- Experience defining control-effectiveness methods, maturity measures, KPIs and KRIs for executive reporting.
- Experience advising executives, steering committees or comparable governance bodies.
- Able to work independently as a trusted advisor while collaborating with PMs and technical SMEs.
Nice to have
- Cybersecurity experience in healthcare (ideally a Canadian health authority), the public sector or another highly regulated environment.
- Experience in federated or shared-services organizations.
- Experience integrating NIST CSF with CIS Controls, ISO/IEC 27001/27002, COBIT and Zero Trust principles.
- Strong understanding of Microsoft enterprise security (Azure, Entra ID, Sentinel, Defender XDR, Defender for Cloud, Purview).
- Experience with security investment cases, multi-year funding decisions, audit readiness or regulatory assessments.
Certifications (one or more preferred): CISSP, CISM, CRISC, CCSP, SABSA or equivalent, ISO/IEC 27001 Lead Implementer or Lead Auditor, or relevant Microsoft security certifications. Certifications support demonstrated leadership experience; they don't replace it.
Affinity Earn
Know someone who’s great for this, or any of our open roles? Earn up to $4,000/year for each successful referral through Affinity Earn. You can also earn up to $50,000 for helping us find new clients. Learn about our referral program at https://affinity-group.ca/earn/ or browse our jobs & follow us at https://www.linkedin.com/company/affinity-staffing/jobs/
About Affinity
Affinity Group is a technology and business consulting and services company. We believe in creating long term relationships between clients and consultants that foster a mutually beneficial partnership. Affinity is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All employment is decided on the basis of qualifications, merit and business need.
For more information on Affinity, please visit www.affinity-group.ca
Job Number: 14160
