Why join the CanDeal Team?
CanDeal Group is a leading provider of electronic marketplaces, data services, and technology solutions serving the Canadian capital markets. Through its marketplaces and data businesses, CanDeal delivers trading, pricing, analytics, and infrastructure solutions that support dealers, institutional investors, market participants, and technology providers across the fixed income and derivatives ecosystem.
Owned by Canada's leading financial institutions and market infrastructure providers, CanDeal combines the innovation and agility of a fintech with the scale, credibility, and market reach of an established industry leader. As CanDeal continues to expand its technology, data, and product offerings, legal support is increasingly critical to enabling innovation while managing risk.
This is an exciting time to join a growing organization led by visionary leaders who are helping to shape their industry’s future.
About the Role
We’re looking for a driven security professional who wants to make an impact. This role provides broad exposure across Information Security governance, risk and assurance, with the opportunity to influence decisions, challenge existing approaches and help shape how security is implemented across the organization.
You’ll lead key activities across security governance, policy, risk management, business impact assessment, third-party security risk and assurance. Success in this role requires someone who can work independently, bring together complex or fragmented information, engage stakeholders across Technology and the business, and turn security requirements into practical outcomes.
It’s a role for someone who wants to keep learning, take on increasingly complex challenges and grow their responsibilities and influence over time.
What You’ll Do
- Lead the Information Security policy framework, standards, control library and review cycle, ensuring alignment across related security governance frameworks.
- Maintain the Information Security Risk Management Framework and coordinate the security risk register, including risk assessment, treatment, acceptance, monitoring, evidence, escalation and closure.
- Lead and facilitate security risk assessments for technology initiatives, systems, vendors and material changes, providing effective challenge and documenting risk decisions and required treatments.
- Lead the enterprise Business Impact Assessment (BIA) governance process, including methodology, facilitation, challenge, exercises, findings, action tracking and consolidated reporting, while business owners remain accountable for business impacts and recovery requirements.
- Lead third-party cybersecurity risk oversight, including intake, tiering, assessments, security requirements, exceptions, monitoring and reporting, working with Security Operations and Assurance where deeper technical expertise is required.
- Coordinate Information Security support for regulatory reviews, audits, customer assessments and independent assurance activities.
- Track security findings and remediation commitments arising from risk assessments, audits and assurance activities, including escalation where appropriate.
- Develop security risk and governance metrics, committee materials, decision records and executive-level reporting.
- Provide governance guidance, procedures, control interpretation and evidence standards to Technology, Security Operations and other control owners.
- Coordinate cybersecurity incident governance, exercises and consolidated lessons learned while Technology and operational teams retain responsibility for technical response and recovery.
- Support security awareness, phishing exercises and targeted security communications, including completion tracking, metrics and escalation.
- Monitor relevant cybersecurity regulatory, industry and control-framework developments and assess their impact on security governance requirements.
- Identify opportunities to strengthen and simplify security governance practices and constructively challenge existing approaches where improvements can be made.
What You Bring
- 5+ years of relevant experience in information security, cybersecurity governance, technology risk, or a related discipline.
- Demonstrated experience independently leading security, risk or governance initiatives and driving them from problem identification through recommendation, stakeholder alignment and implementation.
- Experience developing and maintaining information security policies, standards and control frameworks.
- Practical experience conducting information security or technology risk assessments, evaluating controls and managing risk-treatment activities.
- Experience with third-party cybersecurity risk assessments, evidence reviews, findings and remediation tracking.
- Working knowledge of business continuity, disaster recovery and BIA concepts.
- Experience supporting regulatory reviews, internal or external audits, customer security assessments or assurance activities.
- Knowledge of recognized cybersecurity and control frameworks such as NIST CSF, NIST SP 800-53, ISO/IEC 27001/27002, CIS Controls and SOC 2.
- Understanding of security domains including identity and access management, vulnerability management, cloud and network security, data protection, application security and incident response.
- Strong written and verbal communication skills, including the ability to translate technical or complex security issues into clear business risks and recommendations.
- University degree or college diploma in Cybersecurity, Information Technology, Computer Science, Risk Management, Business or a related discipline, or an equivalent combination of education and relevant experience.
- Professional certification such as CISSP, CISM, CRISC, CISA or an ISO 27001-related certification.
Preferred
- Experience within a regulated financial-services environment.
- Familiarity with Canadian financial-sector regulatory and cybersecurity requirements, including OSFI and Canadian Investment Regulatory Organization (CIRO) requirements, is an asset.
- Experience with SOC 2, ISO 27001 or similar control and assurance environments.
- Experience with GRC platforms or other structured risk-management tooling.
- Experience facilitating BIAs, tabletop exercises, risk workshops or control assessments.
How You Work
- Driven and accountable: You take ownership, identify what needs attention and move work forward without waiting for detailed direction.
- Able to connect the dots: You can bring together fragmented information, understand dependencies and turn complexity into clear, practical solutions.
- Influential: You build credibility and gain alignment across Technology, business and leadership teams, even when you do not have direct authority.
- A constructive challenger: You question assumptions and the status quo while maintaining productive relationships and proposing better approaches.
- Pragmatic: You balance security and risk objectives with business and technology realities.
- Decisive: You exercise sound judgment, develop well-reasoned recommendations and recognize when an issue requires escalation.
- Focused on outcomes: You follow through on decisions and commitments and help ensure security requirements are translated into sustainable practices.
- Curious and growth-oriented: You continuously expand your knowledge, take on new challenges and look for opportunities to improve.
Please inform us if you require any accommodations during the hiring process.
Thank you for your interest in joining our team. Please note that only candidates selected for an interview will be contacted.
