Cybersecurity Risk Specialist (13561)

Toronto Transit Commission (TTC); Toronto; Hybrid; CAD 100,000 - 125,000; Full time

Benefits offered by this job

Pension plan

Health, dental, vision

Job summary

The Toronto Transit Commission (TTC) is seeking a Cybersecurity Risk Manager in the Information Technology Services - Cybersecurity Risk Management department. You will conduct risk assessments, monitor threats, maintain risk registers, and lead mitigation strategies.

You will develop and implement governance, policies, standards, data classification, and oversee compliance activities while coordinating with internal and external stakeholders to strengthen TTC's security posture.

Qualifications

• University degree in Computer Science, Information Security, Cybersecurity, or related field.
• Several years of cybersecurity risk management or governance, risk and compliance experience.
• Experience with Microsoft and Linux platforms.

Responsibilities

• Conduct security risk assessments, monitor threats, maintain risk registers, and drive mitigation strategies.
• Develop governance, policies, standards, and data classification requirements.
• Oversee compliance activities and coordinate remediation with stakeholders.

Skills

Cybersecurity Risk Management

Governance, Risk & Compliance

Microsoft & Linux

Policy Development

Vendor Risk Management

Threat Modeling

Analytical Thinking

Communication Skills

Education

University degree in Computer Science/Information Security/Cybersecurity

Tools

NIST CSF

ISO/IEC 27001/27002

SOC 2

Job description

Department: Information Technology Services - Cybersecurity Risk Management

Salary Information: $ 100,318.40 - $ 125,434.40

Employment Type: Regular - Hybrid

Vacancy: Existing

Weekly Hours: 35 Off Days: Saturday-Sunday Shift: Day

Posted On: August 21, 2026

Last Day to Apply: September 4, 2026

Reports to: Director, Cybersecurity Risk Management

The Toronto Transit Commission (TTC), North America's third largest transit system and recognized as one of the top places to work in the GTA has introduced its new 2024-2028 TTC Corporate Plan - Moving Toronto, Connecting Communities which continues the TTC’s legacy of delivering service to hundreds of millions of customers a year. The TTC’s new vision and mission statements also help promote the many environmental, social equity and economic benefits that the TTC provides:

Vision: Moving Toronto towards a more equitable, sustainable, and prosperous future.

Mission: To serve the needs of transit riders by providing a safe, reliable, efficient, and accessible mass public transit service through a seamless integrated network to create access to opportunity for everyone.

The full Plan can be viewed on ttc.ca.

What You Will Do

Cybersecurity Risk Assessment & Mitigation: Conduct security and threat risk assessments, identify and monitor cybersecurity risks, maintain risk registers, and recommend risk mitigation strategies.

Cybersecurity Maturity & Continuous Improvement: Assess cybersecurity capabilities against recognized frameworks and industry best practices and recommend improvements to strengthen the organization's security posture

Governance, Policies & Standards: Develop, implement, and maintain cybersecurity policies, standards, governance frameworks, and data classification requirements to support business and regulatory objectives.

Compliance & Control Assurance: Assess security controls, manage compliance and exceptions, identify control gaps, and coordinate remediation activities to ensure adherence to regulatory, legal, and organizational requirements.

Audit & Regulatory Coordination: Support internal and external audits, assessments, and regulatory reviews, ensuring timely responses, evidence collection, and resolution of findings.

Third-Party & Vendor Risk Management: Conduct vendor risk assessments and due diligence, review procurement and contract documentation for security and privacy requirements, monitor third-party risks throughout the vendor lifecycle, maintain vendor risk inventories, and communicate risk findings and recommendations to stakeholders.

Cybersecurity Program & GRC Management: Support cybersecurity programs, projects, and initiatives, and administer and enhance governance, risk, and compliance (GRC) tools, processes, and reporting capabilities.

Reporting & Stakeholder Engagement: Develop reports, metrics, and presentations; communicate cybersecurity risks and recommendations; and collaborate with technical and business stakeholders to support informed decision-making.

Security Resilience & Incident Preparedness: Support the development, testing, and continuous improvement of cybersecurity incident response, business continuity, and disaster recovery plans and procedures.

Security Awareness & Data Protection: Promote cybersecurity awareness and secure practices across the organization, and support the enhancement of data protection capabilities, including Data Loss Prevention (DLP).

Cybersecurity Expertise & Continuous Improvement: Monitor emerging threats, technologies, and industry best practices, and serve as a subject matter expert on cybersecurity risk, governance, and compliance.

Promote a respectful work and service environment that supports diversity, inclusion, and is free from harassment and discrimination. Provide leadership in the development and implementation of inclusive and accessible policies, programs and/or services for employees and customers in accordance with TTC’s commitments and obligations under the Ontario Human Rights Code (OHRC) and Related Orders, the Accessibility for Ontarians with Disabilities Act (AODA), and TTC’s policies.

Participate in the TTC Ambassador Program.

What Qualifications Do You Bring?

• University degree in Computer Science, Information Security, Cybersecurity, or a related field as well as directly responsible working experience in Cybersecurity risk management or combination of education, training, and experience deemed to be equivalent
• Several years of relevant Cybersecurity experience in Governance, Risk and Compliance
• Several years of Information Technology experience in Microsoft and Linux platforms
• Experience with security frameworks (such as NIST CSF, ISO/IEC 27001/27002, and SOC2) and creation of policies, standards and procedures
• Experience with Privacy and Security requirements such as PHIPA, PIPEDA, MFIPPA, Canada’s antispam legislation (CASL), ISO IEC 27001, ISA IEC 62443, PCI DSS
• Experience in applicable information security management, governance, and compliance principles, practices, laws, rules and regulations
• Strong understanding of Information technology systems and processes, network infrastructure, data architecture, data processes, and protocols
• Strong decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate one
• Strong analytical, problem-solving and troubleshooting skills
• An understanding of organizational mission, values, goals and consistent application of this knowledge
• Ability to work in a fast-paced environment managing multiple priorities with proven time management skills.

One of these certifications will be considered an asset:

• Certified in Risk and Information Systems Control (CRISC)
• Certified Information Systems Auditor (CISA)
• GIAC Systems and Network Auditor (GSNA)
• Certified Information Systems Security Professional (CISSP)

What We Offer

• Commitment to creating a diverse, equitable and inclusive culture that promotes a sense of belonging and represents and reflects the needs of the communities we serve.
• One of the great benefits of being a full-time TTC employee is becoming a member of the TTC defined pension plan.
• A comprehensive package that covers health, dental, vision and more.

Commitment to EDI

The TTC is committed to upholding the values of equity, diversity, anti-racism and inclusion in the delivery of its services and in its workplaces. The TTC is committed to fostering a diverse workforce that is representative of the communities it serves at all levels of the organization and supports an inclusive environment where diverse employee and community perspectives and experiences bring value to the organization. The TTC encourages applications from all applicants, including members of groups with historical and/or current barriers to equity, including but not limited to, Indigenous, Black and racialized groups, people with disabilities, women and people from the LGBTQIA+ community. The TTC values and supports an inclusive and barrier-free recruitment and selection process. Accommodations for applicants are available upon request throughout the recruitment and selection process, including for those who identify as having a disability. Please contact Talent Management at [phone] or [e-mail] . Any information received related to an accommodation will be addressed confidentially.

General Prohibition in Hiring Process

The TTC is also committed to a fair hiring process based on job related qualifications, merit, and abilities. You are expected to write your own materials and provide your own qualifications and experiences during the hiring process. The TTC will not tolerate the use of artificial intelligence or external resources in any of your submissions or responses or the disclosure of interview questions to others. By submitting your application, you acknowledge and agree to the following:

• The use of any artificial intelligence (AI) tool including, but not limited to, ChatGPT and Microsoft Copilot, to generate or produce any information or materials to be submitted or any response to any assessment question or any interview question, is prohibited.
• All information and materials you submit, including resume, cover letter, and assessment responses, are your own original work without the use of any AI tool
• During any interview, your response to any interview question is your own without the use or assistance of any AI tool or any person.
• You will not disseminate or disclose to any person any interview question.

Should you breach the prohibition of AI tool use, or information dissemination or disclosure, you will be in violation of TTC’s hiring process and TTC may withdraw your application and may prohibit you from participation in the TTC hiring process.

Relatives of TTC Employees

The TTC’s policy prohibits relatives of current TTC employees from being hired, assigned, transferred or promoted into positions, where there is a conflict of interest due to a relationship. Should you be selected for an interview, you will be required to disclose the name, relationship and position of any relative who is a current TTC employee.

We thank all applicants for their interest but advise only those selected for an interview will be contacted.