Information Security Specialist - CISA, GRC

Location: Toronto, ON

Hybrid – currently 2 days in office, with potential to increase to 4 days

• Position Type: Contract
• Contract Duration: 6 months (extension possible)
• Pay Rate: C$86.00–C$103.00 / Hour (CAD)
• Shift / Schedule: Monday–Friday, 9:00 AM–5:00 PM
• Travel Requirements: Not required

TD Global Security & Defense is home to a team of highly valued professionals who support all Global Technology Solutions related regulatory and support interactions, which includes business, 2nd, or 3rd LOD led exams. They provide oversight and governance, independently challenging high/medium severity issues tied to regulatory, audit, and ORM, including issue escalations tied to potential overdue and validation failures, issue support for insight, governance reporting and exams, and demand management support assurance functions.

This role is focused on providing governance, risk, compliance, and issue remediation oversight and control best practices that meet TD's overarching Global Technology Solutions strategy and objectives. The individual will be responsible for partnering with Technology segments to support independent challenge and oversight of issue remediation plans impacting the information security control environment. This is a senior IT Audit / Cybersecurity Risk & Remediation Assurance role focused on validating that audit and regulatory findings have been properly remediated before they are reviewed by auditors or regulators. The role involves both project-based work and day-to-day operations, and the contractor will have access to customer data.

• Lead assessments of audit and regulatory finding remediations required to mitigate risk within technology infrastructure and applications, working with stakeholders across the three lines of defense to ensure effective risk mitigation and remediation
• Provide advice and guidance to Technology segments and Technology Risk Services on various areas requiring subject matter expertise and interpretation: Audit & Assurance Standards; IT Risk Governance Control Frameworks; and GRC (Governance, Risk, and Compliance) frameworks
• Contribute to the development of mature Governance Oversight & Control practices, through improvement of Risk Identification, Control Design and Operating Effectiveness
• Identify emerging themes, understand trends, and provide specialized business management advice to senior management and respective teams while raising industry, external and internal, enterprise and business awareness
• Lead continuous improvement projects, leveraging agile / lean continuous improvement practices/methods that demonstrate sustainable and leading edge solutions (e.g., Artificial Intelligence (AI), Machine Learning (ML), Power BI/Apps, Python, etc.)
• Perform sample-based testing using the IOR methodology: Inspection, Observation, and Reperformance
• Assess design effectiveness, implementation, operational effectiveness, and sustainability
• Trace testing back to evidence
• Perform end-to-end QA of remediation plans; determine whether remediation is complete, risk-aligned, sufficiently evidenced, and validation-ready
• Assess root cause, risk reduction, design/operating effectiveness, and sustainability
• Produce testing scripts, results, QA rubric, and close-out memo
• Lead risk-focused reviews and challenge meetings; challenge issue owners and remediation teams using testing/QA results
• Work across 1st, 2nd, and 3rd lines of defense
• Interact with senior stakeholders including VP/SVP/EVP-level stakeholders
• Strengthen the independent assurance, governance, and oversight operations, utilizing lean continuous improvement practices and tools
• Apply core Agile frameworks (e.g., Scrum, Kanban) to execute operational workplan projects
• Collaborate with data scientists, engineers, information security specialists, and business stakeholders to align AI initiatives with strategic objectives
• Train colleagues and team members related to risk and compliance of issue remediations
• Manage multiple efforts simultaneously, prioritize demands, and apply strong organizational skills
• Stay current with the latest research and trends in AI/ML and recommend relevant tools, frameworks, and methodologies
• Identify common themes across different findings/segments that could indicate a systemic or enterprise-wide issue and escalate those themes to senior leadership
• Participate in continuous improvement, including using AI and other tools to improve QA/testing efficiency

• IT audit - IT Governance Controls and Standards – 10 years
• Quality assurance as it relates to remediation plans – 10 years
• Very strong comms – written and verbal- key
• IT governance experience in information security and controls risk frameworks – 10 Years
• Experience with assessing evaluation of audit and regulatory remediation – 10 years
• governance frameworks
• Team player – collaborate well with other team members
• Knowledge and experience with various technology tools including, but not limited to, RSA Archer, JIRA, Confluence, Sharepoint, MS Office, Excel. SERVICENOW
• IOR methodology OR comparable audit validation approaches.
• Strong auditor mindset
• Experience developing sample based test plans – 10 years
• CISA certification

• Expert knowledge of IT Audit and Control methodology, IT Governance Controls and Standards, and associated tools to ascertain the quality and effectiveness of technology remediation plans
• Competencies in technology controls, emerging threats, and technology risk disciplines and practices
• IT governance experience in information security and controls risk frameworks (i.e., ITIL, NIST, COBIT)
• Knowledge and experience with various lifecycle methodologies / frameworks, i.e., Agile, Project Management, IT Processes, Risk Management frameworks and process / operations
• Excellent verbal and written business communication skills; meticulous documentation
• Ability to effectively interact with individuals across the organization and at various levels (technical, business, Senior & Executive Management)
• Attention to detail
• Ability to challenge remediation while maintaining collaborative relationships
• Diplomacy, compassion, and respect; collaboration and consensus-building
• Ability to handle difficult/challenging conversations
• Executive-level communication and strong documentation skills
• Information Security or technology risk and controls background (financial industry experience a plus)

• CISSP certification or equivalent experience
• Microsoft Copilot / AI – user-level proficiency, not development
• Big 4 or major bank technology/IT audit or cybersecurity audit background
• Banking experience (candidates from major financial institutions are considered)

• University degree in a relevant field or equivalent experience
• CRISC certification or equivalent experience required
• CISSP certification or equivalent experience (a plus / nice to have)

• 10 years as an IT Risk Specialist with relevant experience in governance, risk, and compliance management within regulated industries
• IT audit specifically focused on Information Security / Cybersecurity
• Audit remediation validation/assurance experience

• Hybrid work environment – currently 2 days per week in office in Mississauga, ON, with potential to increase to 4 days
• Overtime: Not required
• Rotation: Not required
• Team size: approximately 15 people
• Training period: shadowing
• Individual contributor role; performance measured by deliverables and quality of work
• Contractor will have access to customer data

• Interview process: 1 panel interview (approximately 1 hour), covering technical and behavioural questions - conducted virtually
• Candidates should be prepared to discuss a specific example of sample-based remediation testing using the IOR methodology (Inspection, Observation, Reperformance), including testing methodology, sampling approach, evidence assessment, professional judgment, remediation challenge, and final validation outcome
• Candidates whose audit experience is primarily financial, operational, or non-technology related are not a fit for this role

• Medical, Vision, and Dental Insurance Plans
• 401k Retirement Fund

This client is a leading financial services and banking institution operating across Canada and internationally, employing tens of thousands of professionals across technology, risk, compliance, cybersecurity, and business functions. The organization's Global Security & Defense division supports enterprise-wide regulatory governance and audit assurance, bringing together information security specialists, IT risk professionals, data engineers, and compliance experts who collaborate across all three lines of defense.

GTT is a minority-owned staffing firm and a subsidiary of Chenega Corporation, a Native American-owned company in Alaska. We highly value diverse and inclusive workplaces and support Fortune 500 organizations across banking, financial services, technology, life sciences, biotech, utilities, and retail sectors throughout the U.S. and Canada.

Job Number: 26-10988