Cyber Risk Assessor

The Cyber Risk Assessor will conduct security and architecture assessments, threat modeling, and design/solution reviews across applications, platforms, and cloud environments. The role will identify cybersecurity and IAM control gaps, evaluate risks against the client security standards and best practices, and recommend actionable remediation options to strengthen the client’s overall security posture. As a member of the  Division, the Cyber Risk Assessor will provide resource augmentation and specialized expertise in cyber advisory services and risk assessment delivery.

The successful candidate will be an experienced cyber risk management professional with strong technical and business transformation acumen, demonstrated solution delivery leadership, and a proven track record of driving alignment between business and technical stakeholders. This role will enable consistent execution of security architecture and IAM priorities including secure design, identity governance, privileged access, and secure cloud adoption through practical guidance, clear risk articulation, and effective stakeholder engagement.
The Specialist will be working a hybrid work model but is subject to change, the Specialist is required to work from Metro Hall located at 55 John Street in Toronto – minimum 3 days per week. The current hybrid work arrangement can change due to the client mandate and/or at discretion of  Senior Management and may be required to report to work at specified location up to 5 days per week during the term of the contract. The successful candidate will be working seven
(7) hours per day, five (5) days per week based on normal working Business Hours.

The client reserves the right to disqualify any resource proposed by a Supplier if that resource has previously been engaged as a contractor with the client.Assignment Duties
 

1. Assess and advise on IAM architecture and controls, including authentication and authorization patterns, least privilege, role/entitlement design, privileged access management (PAM), identity lifecycle processes (joiner/mover/leaver), and segregation of duties.
2.  
3. Evaluate cloud security architecture and posture across IaaS/PaaS/SaaS implementations, including landing zone and guardrail controls, encryption and key management, secrets management, logging/monitoring, network segmentation, and secure configuration baselines.
4.  
5. Support enterprise governance and assurance gates by producing and maintaining required security artifacts (e.g., security assessment reports, threat models, control mappings, risk acceptances, conditions of approval) and contributing to architecture/security review forums.

1. Collaborate with cross?functional stakeholders (delivery teams, enterprise architecture, infrastructure/operations, privacy, legal, procurement, and service owners) to translate security requirements into implementable solutions and ensure operational readiness.
2.  
3. Assess third?party and vendor solution risks by reviewing security architecture, IAM integration approaches, cloud control claims, and evidence of control effectiveness, supporting procurement and due diligence activities as needed.
4.  
5. Provide clear, defensible documentation and communication for technical and non?technical audiences, including executive summaries that articulate risk, trade?offs, residual exposure, and decision points to support accountable decision?making.

1. Contribute to continuous improvement by identifying recurring systemic gaps (architecture, IAM, cloud), recommending updates to standards/patterns, and promoting reusable security reference architectures and templates
2.  
3. Experience and Qualifications

1. ???????Post-secondary degree in Business, Technology, Information Security, Computer Science, Engineering, or a related discipline; or an equivalent combination of education and demonstrated experience.

1. 1. Extensive experience conducting security architecture reviews, cyber risk assessments, and threat modeling for enterprise-scale solutions (applications, integrations, infrastructure, and cloud services) in a large, complex environment.

1. 1. Demonstrated expertise in Identity and Access Management (IAM), including authentication and authorization design, RBAC/ABAC patterns, privileged access management (PAM), identity lifecycle processes (joiner/mover/leaver), and segregation of duties.

1. 1. Strong understanding of security frameworks, industry standards, and control baselines, such as NIST (CSF/800-series), ISO/IEC 27001/27002, CIS Controls/Benchmarks, CSA Cloud Controls Matrix (CCM), and relevant privacy/security requirements.

1. 1. Experience assessing security controls across cloud and hybrid environments (IaaS/PaaS/SaaS), including secure landing zones/guardrails, encryption and key management, logging/monitoring, vulnerability management, secrets management, and secure configuration practices.
   2. Working knowledge of cloud platforms and security services (e.g., Microsoft Azure, AWS, Google Cloud), including native IAM capabilities and security tooling used to enforce and monitor controls.

1. 1. Experience with application and platform security concepts, including secure SDLC, CI/CD considerations, container and/or serverless patterns, API security, network segmentation, and secure integration design.
   2. Proven ability to produce clear, defensible security documentation and artifacts (e.g., risk assessments, threat models, control mappings, security requirements, residual risk statements, and risk acceptance recommendations) suitable for governance, audit, and executive reporting.

1. 1. Demonstrated knowledge of governance and assurance processes in regulated or public sector environments, including support for security/privacy review gates, procurement/vendor risk due diligence, and evidence-based decision making.

1. 1. Demonstrated ability to communicate and coordinate effectively across diverse stakeholders, including internal teams, senior leadership, business partners, and external vendors.

1. 1. Proven ability to influence outcomes and achieve objectives through collaboration, stakeholder engagement, and sound judgment.

1. 1. Demonstrated critical thinking, problem solving, and strategic planning skills, applied across diverse types of work and delivery contexts.
   2. Preferred certifications (at least two): CISSP, CISM, CRISC, CCSP, CCSK, GIAC (e.g., GCSA/GCLD), TOGAF, ISO 27001 (LA/LI), or vendor-specific cloud security certifications (e.g., Azure/AWS Security).