About this opportunity
We are looking to add an experienced security and compliance professional to join us as our Security & Compliance Lead for the Digital Health and Discovery Platform (DHDP). Reporting to the National Director, DHDP, this role is accountable for establishing and leading the platform's security, privacy, and compliance programs across a highly distributed national research network. The successful candidate will work closely with technology, legal, and partner organizations to ensure the DHDP maintains the highest standards of security and regulatory compliance while enabling innovative health research. The ideal candidate is someone who possesses deep expertise in Canadian health privacy regulations and is comfortable operating as the primary security leader.
This is a full-time, temporary position until September 2027.
About the Terry Fox Research Institute and The Digital Health & Discovery Platform
The Terry Fox Research Institute (TFRI), named for Canadian icon Terry Fox, is built on Terry's dream to end cancer through research. Established in 2007, TFRI is a registered charity and invests its funds in cutting-edge cancer research through highly collaborative, team-oriented programs and national research networks. Together with its many research and funding partners, TFRI empowers Canada’s brightest researchers to seek out new transformational and precision medicine discoveries to advance our understanding, diagnosis, and treatment of cancer with the goal of significantly improving outcomes for patients.
The Digital Health and Discovery Platform (DHDP), a research initiative led by the Terry Fox Research Institute (TFRI), is a federated data-sharing and AI software product development project for advancing disease research where critical health data is resident at multiple institutions across Canada. This project sits at the intersection of healthcare and artificial intelligence and is among the first of its kind globally.
Key responsibilities
Governance, Compliance & Privacy
- Serve as the primary security and compliance subject matter expert for DHDP.
- Lead and deliver the DHDP SOC 2 Type II certification program, from scoping and control implementation through external audit and certification.
- Develop and maintain the organization's security governance framework, policies, standards, and procedures.
- Provide security guidance to executive leadership, project teams, and partner organizations.
- Own compliance with Canadian health privacy and data protection requirements across jurisdictions, including PHIPA, Law 25, FIPPA, and PIPEDA.
- Monitor regulatory developments and recommend changes to controls, policies, and platform practices.
- Work collaboratively with hospitals, academic institutions, and industry partners to address compliance and security requirements while supporting successful platform adoption.
Security Architecture & Engineering
- Lead security architecture reviews across the DHDP technology ecosystem in conjunction with the DHDP engineering and product team.
- Review infrastructure-as-code implementations, IAM configurations, RBAC models, secrets management, and privileged access controls.
- Drive security practices across containerized workloads, CI/CD pipelines, cloud infrastructure, and application deployments.
- Work with the Data Scientist to define and maintain the security baseline for partner edge-node deployments.
- Define monitoring and logging requirements across the DHDP Azure environment.
Risk Assessment & Incident Readiness
- Lead risk assessments and support audit activities.
- Establish incident response processes, escalation pathways, and security event management procedures.
- Develop vulnerability management standards, remediation workflows, and risk tracking processes.
- Coordinate third-party assessments, penetration testing, and security reviews.
- Drive access cleanup, control improvements, and risk reduction initiatives during vendor and platform transitions.
Our successful candidate
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related discipline required.
- Minimum 7-10 years of progressive experience in cybersecurity, information security, privacy, compliance, or related disciplines.
- Professional designations such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor, or equivalent.
- Demonstrated experience operating as the primary or sole security leader within a small or scaling organization.
- Demonstrated experience leading a SOC 2 Type II program from planning and control design through certification.
- Experience working in health technology, research platforms, healthcare systems, or similarly regulated environments is an asset.
- Deep knowledge of Canadian privacy legislation, particularly within healthcare, research, or regulated data environments, including in Quebec.
- Excellent written and verbal communication skills with the ability to engage technical and non-technical audiences.
- Strong risk assessment, decision-making, and stakeholder management skills.
- Hands-on experience reviewing cloud infrastructure, infrastructure-as-code, IAM configurations, RBAC policies, and security architecture.
- Familiarity with OHDSI/OMOP, GA4GH standards, or related health research data ecosystems.
- Experience with federated or distributed data architectures where data residency remains at participating sites.
- Experience securing Microsoft Azure environments and cloud-native architectures.
Benefits of working with us
- Flexible schedule
- Paid vacation
- Paid sick days
- Extended medical and dental coverage
- A work culture that values excellence, creativity, teamwork, learning, fairness and integrity
- A passionate group of high-performing teammates across Canada
Salary: $110,000 - $130,000
How to Apply: If you are passionate about making a difference in cancer research, we invite you to submit your application. This position is open to candidates residing in Canada. Please include a cover letter, resume, and any relevant supporting documents. Applications can be submitted through email to hr@tfri.ca.
Application Deadline: job requisition will be open until filled.
We appreciate all applications, but only candidates selected for an interview will be contacted.
We recognize the importance of diversity and equity in our workforce and encourage all qualified applicants to apply, including Indigenous persons, women, persons with disabilities, minorities, and other underrepresented communities.
