Information Security Specialist strengthening technology controls, security governance, and risk management at TD, a major North American bank. Advising partners, assessing controls, supporting audits, and responding to incidents.
About the role
- Head of Security managing information security strategy at Reach. Leading end-to-end security efforts for a global ecommerce platform.
Responsibilities
- Vulnerability management and offensive testing: Own the vuln lifecycle end-to-end — intake, triage, prioritization, risk acceptance, ticketing to dev teams, and remediation within SLA — and manage external pen tests and targeted assessments. Report regularly on status, SLA performance, and trends.
- Security operations and incident response: Manage our MSSP partner for 24/7 SIEM and SOC monitoring; ensure telemetry, detections, and playbooks match our threat model. Serve as incident commander for real events, and run regular tabletops and post-incident reviews.
- Policy, controls, and risk: Define and maintain Reach’s security policies and control framework. Design, implement, and measure the effectiveness of controls; maintain a risk register; and surface material risk decisions to leadership.
- Compliance and audits: Own SOC 2 Type II and PCI DSS end-to-end with continuous control monitoring and evidence collection between audits. Serve as the primary contact for external auditors.
- Application and cloud security: Partner with engineering on secure SDLC, threat modeling for new products and features, SAST/DAST/SCA coverage, and cloud security posture (IAM, configuration, workload protection).
- Identity and access management: Own IAM policy, periodic access reviews, privileged access, and joiner/mover/leaver processes, in partnership with IT and People.
- Third-party and customer security: Run Reach’s vendor risk program (due diligence, questionnaires, DPAs, ongoing monitoring) and own responses to customer and prospect security reviews.
- Security awareness and training: Run phishing simulations, ongoing and role-targeted training, and regular company-wide sessions on new threats and best practices.
- Executive reporting: Provide regular security posture updates with meaningful metrics (MTTD/MTTR, patch latency, control coverage, phishing outcomes, audit readiness).
- People, budget, and tooling: Act as a mentor for your report; own the security budget and tool stack — evaluating, procuring, rationalizing, and retiring tools as the program matures.
Requirements
- 8+ years in information security, with 3+ years leading a security program or a major security function.
- Direct experience owning SOC 2 Type II audits end-to-end; PCI DSS experience strongly preferred.
- Proven, hands-on ownership of vulnerability management programs at scale.
- Experience managing an MSSP/MDR relationship for SIEM and 24/7 SOC.
- Strong application and cloud security fundamentals, with hands-on experience in AWS, GCP, or Azure, and the ability to partner credibly with engineering.
- Experience leading incident response end-to-end, including cross-functional coordination and working with external parties.
- Experience writing and operationalizing security policies against recognized frameworks (NIST CSF, ISO 27001, CIS Controls).
- Excellent written and verbal communication — credible with engineers, executives, auditors, and customers.
- Comfortable as a player-coach in a lean environment, with a strong sense of ownership and bias for action.
- Additional Assets
- Experience in fintech, payments, or ecommerce — ideally cross-border or merchant-of-record.
- Prior experience standing up or scaling a security program at a growth-stage company.
- Familiarity with GRC/continuous compliance platforms (e.g., Vanta, Drata, Secureframe).
- AWS experience (our primary cloud) and Atlassian suite (Jira, Confluence) for workflow and documentation.
- Formal people-management experience.
- Relevant certifications (e.g., CISSP, CISM, CCSP).
Benefits
- Competitive compensation
- Flexible remote work
- Comprehensive benefits
- Opportunity to build and own a security function
- Direct impact on a global commerce platform
- Health insurance
- Retirement plans
- Paid time off
- Professional development
- Bonuses
Job title
Job type
Experience level
Salary
Not specified
Degree requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Buildings, development and security Analyst supporting fire prevention, facility safety, and building management at Desjardins. Analyzing risks, developing safety plans, and implementing physical security systems.
Application Security Developer securing Clio’s AI - powered legal technology platform through .NET development, vulnerability remediation, and automated application security tooling. Hybrid Toronto Hub role.
Senior Security Engineer securing Squads’ stablecoin products, APIs, and infrastructure. Leading threat modeling, code review, vulnerability management, and secure development standards.
Azure Cloud Security Engineer strengthening Azure security, governance, and vulnerability remediation. Supporting ELITS Canada’s digital transformation clients through secure cloud implementation.
BMO banking associate providing bilingual credit and lending sales and service remotely in Quebec. Handling customer contacts, credit decisions, compliance, and suspicious - activity reporting.
Principal Information Security Engineer defining scalable security strategy, architecture, automation, cloud, identity, and AI controls. Helping Arctic Wolf protect organizations worldwide and end cyber risk.
Senior Cybersecurity Architect designing Zero Trust, IAM, SIEM, and cloud security solutions for Manulife’s financial services business. Supporting enterprise architecture, incident response, and security strategy.
Consultant cybersécurité hybride à Montréal chez I - TRACING, pure - player indépendant en sécurité informatique. Conception, déploiement et support de solutions IAM, réseau, systèmes et applications.
Desjardins property technician supporting fire prevention, building safety, management, and build - out projects. Providing technical support, process coordination, user training, and operational guidance.