Security Specialist

Location: Toronto, ON

Hybrid – currently 2 days on-site, moving to 4 days on-site

• Position Type: Contract
• Contract Duration: 6 month (extension possible)
• Pay Rate: C$90.00–C$108.00 / Hour (CAD)
• Shift / Schedule: Monday–Friday, 9:00 AM – 5:00 PM (some overtime possible)
• Travel Requirements: Not required

We are looking for someone who is well-versed at providing governance, risk, compliance and issue remediation oversight and control best practices that meet the organization's overarching Global Technology Solutions strategy and objectives. The individual will be responsible for partnering with Technology segments to support independent challenge and oversight of issue remediation plans impacting the information security control environment.

Independent Remediation Assurance & Testing

• Conduct sample-based testing using the IOR (Inspection, Observation, Reperformance) method to validate the design, implementation, operating effectiveness and sustainability of audit and regulatory remediation activities.
• Perform quality assurance to assess whether remediation plans are complete, risk-aligned and ready to proceed by leveraging a QA rubric, relevant evidence and auditor professional judgement.
• Lead and conduct independent, risk-focused reviews to confirm action plans, milestones and resolutions are credible, sufficiently evidenced and validation-ready - working with stakeholders across the three lines of defense to ensure effective risk mitigation and remediation.
• Evidence and closure defensibility: Assess evidence sufficiency, commitment traceability, milestone credibility, control ownership, residual risk and closure rationale to support audit and regulatory readiness.

Advisory & Governance

• Provide advice and guidance to Technology segments and Technology Risk Services on various areas requiring subject matter expertise and interpretation: Audit & Assurance Standards; IT Risk Governance Control Frameworks; and GRC (Governance, Risk, and Compliance) frameworks.
• Contribute to the development of mature Governance Oversight & Control practices, through improvement of Risk Identification, Control Design and Operating Effectiveness.
• Identify emerging themes, understand trends, and provide specialized business management advice to senior management and respective teams while raising industry, external and internal, enterprise and business awareness.
• Cross-functional challenge and advisory: Partner across the three lines of defense and advise Technology and Technology Risk stakeholders on audit standards, IT risk governance and GRC frameworks.

AI-Enabled Assurance Transformation

• Lead the design and implementation of an AI-enabled bot to support challenge and QA reviews of remediation plans, milestones, and evidence for audit and regulatory findings.
• Translate existing challenge frameworks, QA rubrics, scoring criteria, and regulatory expectations into AI-consumable logic, prompts, and evaluation workflows.
• Develop and maintain AI models capable of:

• Assessing remediation plans for completeness, quality, and risk reduction - Identifying gaps, inconsistencies, and control weaknesses - Producing structured challenge feedback and scoring aligned to established rubrics

• Ensure AI solutions comply with enterprise information security, data protection, privacy, and model risk management standards.
• Partner with model risk, privacy, legal, and technology teams to ensure responsible and compliant AI use.

• Very strong comms – written and verbal- key
• 10 years as an IT Risk Specialist with relevant experience in governance, risk and compliance management within regulated industries.
• Professional technology audit, risk, information security or technology control certification preferred (e.g., CISA, CRISC, CIA or equivalent), with practical experience performing assurance, validation or quality assurance reviews of audit/regulatory findings.
• Formal training or demonstrated competency in audit testing techniques, evidence evaluation, issue remediation validation, root cause analysis and control operating effectiveness assessment.
• AI-enabled assurance transformation: Lead the design and implementation of an AI-enabled capability that supports challenge and QA reviews of remediation plans, milestones and evidence.

• Demonstrated experience applying the IOR (Inspection, Observation, Reperformance) methodology, or comparable audit validation approaches, to test remediation design, implementation, operating effectiveness and sustainability.
• Ability to assess audit and regulatory remediation plans for audit/regulator readiness, including evidence sufficiency, traceability to commitments, milestone credibility, control ownership, residual risk and closure rationale.
• Strong auditor mindset with experience developing sample-based test plans, documenting test results, identifying gaps and challenging remediation evidence using professional judgement and applicable audit/control standards.
• Competencies in technology controls, emerging threats, and technology risk disciplines and practices.
• Strengthen the independent assurance, governance and oversight operations, utilizing lean continuous improvement practices and tools.
• Apply core Agile frameworks (e.g., Scrum, Kanban) to execute operational workplan projects.
• Collaborate with data scientists, engineers, information security specialists, business stakeholders, and corporate partners to align AI initiatives with strategic objectives.
• Ability to train colleagues and team members related to risk and compliance of issue remediations.
• Excellent verbal and written business communication skills; meticulous documentation.
• Ability to manage multiple efforts simultaneously, priority demands and strong organizational skill.
• Ability to effectively interact with individuals across the organization and at various levels (technical, business, Senior & Executive Management) and across all lines of defense.
• Stay current with the latest research and trends in AI/ML and recommend relevant tools, frameworks and methodologies.
• IT governance experience in information security and controls risk frameworks (i.e., ITIL, NIST, COBIT).
• Knowledge and experience with various lifecycle methodologies / frameworks, i.e., Agile, Project Management, IT Processes, Risk Management frameworks and process / operations.
• Knowledge and experience with various technology tools including, but not limited to, ServiceNow, RSA Archer, JIRA, Confluence, SharePoint, MS Office, Excel.
• Attention to detail.
• Strong communication skills.
• Experience working within regulated financial services and interacting with Internal Audit, regulators, second line oversight and technology control owners to support finding closure and examination readiness.
• Information Security or technology risk and controls background (financial industry experience a plus).

• Six Sigma.
• CISSP certification or equivalent experience.
• AI security/risk experience/tools.
• ServiceNow.

• University degree in a relevant field or equivalent experience.
• CRISC certification or equivalent experience.
• CISM certification or equivalent experience.
• CISA certification or equivalent experience.
• Professional audit, risk, information security or technology control certification preferred (e.g., CISA, CRISC, CISSP, CIA or equivalent), with practical experience performing assurance, validation or quality assurance reviews of audit/regulatory findings.
• CISSP certification or equivalent experience (a plus).

This client is a leading financial services and banking institution operating across Canada and internationally, with a large and collaborative technology organization that includes professionals in IT risk, information security, governance, compliance, audit, data science, and engineering. The organization employs thousands of technology and risk specialists and places a strong emphasis on long-term growth, agility, and responsible innovation - including the adoption of AI-enabled tools and frameworks across its control environment.

GTT is an NMSDC-certified Minority Business Enterprise (MBE) headquartered in Portsmouth, New Hampshire. GTT is a subsidiary of Chenega Corporation, an Alaska-based company and one of the largest Alaska Native-owned corporations. An Inc. 5000 honoree and one of SIA's Best Staffing Firms to Work For, GTT connects professionals with Fortune 500 organizations across IT, engineering, construction, utilities, life sciences, financial services, and healthcare throughout the U.S. and Canada. We're committed to diverse, inclusive workplaces and to placing people in roles where they can do their best work.

Job Number: 26-18634