Senior Security Specialist protecting BDO Canada’s enterprise systems through threat detection, incident response, and vulnerability management. Supporting security operations across blended office, client - site, and virtual environments.
About the role
- Senior Consultant leading cyber regulatory remediation for banks, broker-dealers, and insurers. Driving incident response, vulnerability, patch, and IAM workstreams to closure.
Responsibilities
- Translate MRAs, MRIAs, Consent Orders, and NY DFS 500.17 cybersecurity event notifications into prioritized remediation plans with milestones, evidence requirements, and validation criteria
- Prepare clients for FRB, OCC, FDIC, NY DFS, SEC, and FFIEC exams and continuous-monitoring touchpoints
- Draft response letters, walkthroughs, evidence packages, and defend the work
- Partner with client CISO, IT Risk, Infrastructure, and IAM teams to close findings and achieve engineering outcomes
- Lead or co-lead client-side incident response for material events, including containment, forensic coordination, regulator and law-enforcement notification timing, executive and board communications, and post-incident remediation
- Assess vulnerability and patch management operations, design risk-based SLAs, build exception governance, and operationalize security tooling
- Lead IAM remediation workstreams covering privileged access management, joiner-mover-leaver, recertification, segregation of duties, and identity governance
- Mentor analysts and consultants and review deliverables
- Contribute to proposals, thought leadership, methodology assets, and follow-on client work
Requirements
- Ability to speak credibly to at least three listed regulatory frameworks and regimes based on practical experience
- Hands-on experience leading or coordinating incident response for ransomware, business email compromise, third-party breach, insider, and nation-state events
- Working knowledge of NIST SP 800-61 and MITRE ATT&CK
- Experience coordinating with legal, privacy, communications, forensics, insurance, and regulators under time pressure
- Experience drafting and defending incident notifications and regulator communications under NY DFS Part 500, SEC 8-K Item 1.05, GDPR, and state breach laws
- Demonstrated experience designing or remediating enterprise vulnerability management programs
- Experience with risk scoring including CVSS, EPSS, and KEV; SLA design; exception governance; and metrics
- Operational familiarity with Qualys, Tenable, Rapid7 InsightVM, Wiz, Microsoft Defender for Cloud, and ServiceNow Vulnerability Response
- Patch management at scale across Windows, Linux, network, container, and cloud workloads
- Strong grasp of IAM domains including IGA, PAM, authentication and federation, joiner-mover-leaver, access certification, and SoD
- Working experience with at least two of SailPoint, Saviynt, Okta, Azure AD / Entra ID, Ping, CyberArk, BeyondTrust, and Delinea
- Practical experience reducing standing privilege, designing role models, and remediating orphaned accounts, toxic combinations, shared service accounts, and weak recertification
- SOX ITGC, PCI DSS 4.0, GLBA Safeguards Rule, and SOC 1/SOC 2 attestation work are nice-to-have
Benefits
- Inclusive employer committed to diversity
- Recruitment and selection accommodations available
Job title
Job type
Experience level
Salary
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Cybersecurity Lead strengthening Irth’s SaaS security program for utility infrastructure operators. Owning vulnerability management, incident response, cloud security, compliance, and customer trust.
AI Security Architect defining secure AI architectures, governance, and risk frameworks. Levio delivers digital transformation and large - scale technology projects for clients.
FTTH security expert auditing PON, CPE, and telecom infrastructure for P1 Security. Producing penetration - test reports and remediation guidance for critical network security.
Lead security for Duetto's hotel revenue management platform across AWS, DevSecOps, compliance, incident response, and enterprise customer trust. Own the security posture for a global hospitality technology business.
Senior CyberArk engineer strengthening Manulife’s enterprise privileged - access security platform. Automating PAM operations, integrations, resilience, and production support.
Security Engineer building IAM, PAM, and IGA capabilities for Marqeta’s cloud - based embedded finance platform. Automating access controls across AWS, SaaS, DevOps, and AI/ML systems.
Senior Security Engineer securing gaiia’s cloud - based telecom operating system. Protecting applications, infrastructure, customer data, and compliance programs across a serverless TypeScript platform.
Cloud security leader supporting ServiceNow’s AI - native SaaS security and Canadian enterprise customers. Leading customer security engagements, incident investigations, and cloud security improvements.
Cyber Security Specialist protecting Scarborough Health Network hospitals and healthcare infrastructure. Managing security systems, assessments, vulnerabilities, incidents, and compliance across the Central East Region.