Security Analyst - Intermediate JP226

P@thlion Staffing Careers; Toronto; On-site; CAD 90,000 - 130,000; Full time

Job summary

P@thlion Staffing Careers is seeking an IT Security Governance Analyst to support governance, compliance, and audit programs for Payments (PRESTO) ITSEC. You will help define KPIs, drive risk-based decisions, and coordinate with Risk & Compliance, Privacy, and Finance to manage cyber risk across the organization.

Ideal candidates have 4–6 years in IT security, experience with ISO 27001/NIST, and security governance projects.

Qualifications

• Minimum 4–6 years in progressively advancing IT or related roles with focus on IT security.
• Experience designing and auditing ITSEC governance, compliance, and risk management.
• Certifications in information security are assets (CISSP/CISM/CGEIT/CRISC/CISA).

Responsibilities

• Support ITSEC governance, compliance, audit, and reporting for Payments (PRESTO).
• Develop ITSEC KPIs and report cybersecurity effectiveness to stakeholders.
• Collaborate across Risk & Compliance, Privacy, Records Management, and Finance.
• Maintain ISO 27001 and NIST-aligned governance, controls, and audit readiness.
• Coordinate third-party cyber risk management and vendor security reviews.
• Assist with security audits including PCI, CSAE 3416, and internal/external reviews.

Skills

IT security experience

Operational security monitoring

Incident response

TCP/IP knowledge

Unix/Windows systems

Network infrastructure knowledge

Cyber attack types knowledge

Threat analysis

Risk assessment

Cybersecurity product evaluation

Education

Bachelor's degree in IT/CS/Engineering

Tools

CISSP

CISM

CGEIT

CRISC

CISA

Job description

Responsibilities Perform real time monitoring and analysis of events with a focus on identifying potential security incidents. Respond and investigate potential alerts and tickets. Collect and analyze evidence including network traffic, volatile data, logs and other indicators. General Skills Experience in IT Security, operational security monitoring, incident response. Understanding of TCP/IP stack, *nix/Windows systems Knowledge of network infrastructure and internet applications Understanding of different cyber-attacks Knowledge of security threats and attack types Analysis of cyber threats and experience in providing action plans Ability to investigate, evaluate and recommend Cyber Security products and intrusion detection technology to minimize vulnerabilities.

ACCOUNTABILITY STATEMENT

The Governance Analyst will be responsible for supporting the development and maintenance of Payments (PRESTO) ITSEC governance, compliance, audit, and reporting capabilities. The Governance Analyst will contribute to ensuring that:

Payments (PRESTO) projects adhere to ITSEC policies.

Payments (PRESTO) complies with relevant policies, including those from the Government of Ontario, PCI, NIST, and other applicable cybersecurity standards (ISO 27001).

All security audit requirements are fulfilled. Appropriate cyber risk reporting is provided to internal and external stakeholders.

KEY CONTRIBUTIONS Functional/Technical

Design ITSEC performance KPIs and report on them to appropriate stakeholders as a means of measuring and evaluating cybersecurity effectiveness.

Foster relationships across the organization to promote awareness of compliance and ITSEC principles.

Contribute to development and implementation of Payments (PRESTO) Third-party Cyber Risk Management framework, participating in its design and execution to align with ITSEC governance objectives and industry best practices

Provide timely updates and reports to internal and external stakeholders, including Senior Management Team (SMT), Audit, Finance, and others as necessary.

Collaborate with Risk & Compliance, Privacy, Records Management, and Finance departments to understand the risk appetite for key business applications and coordinate appropriate treatment of identified cyber risks that exceed accepted risk levels.

Work with IT Operations and Risk & Compliance teams to develop and maintain digital assets inventory management systems, ensuring proper identification, classification, ownership, and associated risks and compliance requirements.

Manage governance activities to maintain full compliance with ISO 27001, Privacy (FIPPA), and NIST standards. IT Security Governance Analyst - 1733 Effective Date - May 12, 2023

Support security audit activities, including PCI audits, internal audits, and external audits such as CSAE 3416.

Customer/Stakeholder

Communicates with the organization's end users regarding appropriate Governance activities and issues as necessary

Works closely with business units to manage and execute contractual and legal governance requirements dealing with Payments cyber security requirements

Assists the extended teams (VMO, Procurement etc.) with the alignment of the design and operationalization of Metrolinx Cybersecurity risk management practices as they apply to third party contracts including:

• Assessment of third party and contract risks prior to execution
• Determines relevant security controls that should be embedded with security controls that are applicable to third parties
• Designs and review of service level agreements and management reporting templates for third parties
• Ensures the appropriate involvement of internal/external stakeholders during the design of the proposed third-party solution contract
• Implementation of internal control measures to corroborate security reports from third parties
• Reviews of vendor security control attestation reports and assesses the implications of gaps/breaches as they occur.
• Provides input into the renewal/termination of contractual arrangements for outsourced services as contract periods lapse.

Operational Excellence

Identifies the effectiveness and completeness of business and technologies strategies applicable to ITSEC Governance and ensures alignment with I&IT, Payments (PRESTO) and other applicable cross organization strategies

Assist in developing ITSEC governance awareness-training program for resources as necessary and applicable (employees, contractors and/or approved system users)

Provides subject matter expertise regarding industry standards, regulations and best practices relevant to the ITSEC Governance

People Leadership

Provides security guidance and assists others in the performance of their day-to-day activities without direct supervisory responsibility

Education

Completion of a degree in Business, Engineering, Information Systems, Computer Science or a related discipline – or a combination of education, training and experience deemed equivalent. Experience

Minimum 4-6 years of experience in progressively advancing roles within IT or a related function, with a focus on IT Security/Cybersecurity. Strong track record of competency in risk management and cybersecurity management in IT, with 3 to 5 years of relevant experience. Certifications or Designations

Professional security management certification is an asset, such as, Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Governance of Enterprise IT (CGEIT), Certified Risk and Information Systems Controls (CRISC), Certified Information Systems Auditor (CISA) or other similar credentials an asset

Agile certification (Agile Certified Professional, Certified Scrum Product Owner) an asset

Experience in IT Project Delivery or Operations an asset