Information Security Lead

Terry Fox Research Institute; Canada; On-site; CAD 120,000 - 170,000; Full time

Benefits offered by this job

Paid vacation

Extended medical and dental coverage

Diversity and equity friendly culture

Job summary

The Terry Fox Research Institute is seeking a Security & Compliance Lead for the Digital Health and Discovery Platform to establish and drive security, privacy, and regulatory programs across a national research network. You will partner with technology, legal, and partner organizations to ensure Canada’s top health research standards while enabling impactful work.

This full‑time, temporary role extends to September 2027, requiring a Canadian privacy focus, strong leadership, and hands‑on

Qualifications

• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or related discipline.
• 7–10 years of progressive experience in cybersecurity, information security, privacy, or related disciplines.
• Professional designations such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor, or equivalent.
• Experience as primary security leader within a small or scaling organization.
• Experience leading a SOC 2 Type II program from planning through certification.
• Experience in health technology, research platforms, or regulated environments is an asset.
• Deep knowledge of Canadian privacy legislation in healthcare/research contexts.

Responsibilities

• Serve as the primary security and compliance SME for DHDP.
• Lead and deliver SOC 2 Type II certification program end-to-end.
• Develop and maintain security governance framework, policies, standards, and procedures.
• Provide security guidance to executives, project teams, and partners.
• Ensure compliance with Canadian health privacy and data protection (PHIPA, Law 25, FIPPA, PIPEDA).
• Monitor regulatory developments and update controls accordingly.
• Collaborate with hospitals and academia to address security requirements.

Skills

SOC 2 Type II

Canadian privacy regulations

Security governance

Cloud security

Risk assessment

Education

Bachelor's degree in Cybersecurity/CS/IS/Engineering

Tools

OHDSI/OMOP familiarity

GA4GH standards

Azure security

Job description

About the Terry Fox Research Institute and The Digital Health & Discovery Platform

We are looking to add an experienced security and compliance professional to join us as our Security & Compliance Lead for the Digital Health and Discovery Platform (DHDP). Reporting to the National Director, DHDP, this role is accountable for establishing and leading the platform's security, privacy, and compliance programs across a highly distributed national research network. The successful candidate will work closely with technology, legal, and partner organizations to ensure the DHDP maintains the highest standards of security and regulatory compliance while enabling innovative health research. The ideal candidate is someone who possesses deep expertise in Canadian health privacy regulations and is comfortable operating as the primary security leader.

This is a full-time, temporary position until September 2027.

The Terry Fox Research Institute (TFRI), named for Canadian icon Terry Fox, is built on Terry's dream to end cancer through research. Established in 2007, TFRI is a registered charity and invests its funds in cutting-edge cancer research through highly collaborative, team-oriented programs and national research networks. Together with its many research and funding partners, TFRI empowers Canada’s brightest researchers to seek out new transformational and precision medicine discoveries to advance our understanding, diagnosis, and treatment of cancer with the goal of significantly improving outcomes for patients.

The Digital Health and Discovery Platform (DHDP), a research initiative led by the Terry Fox Research Institute (TFRI), is a federated data-sharing and AI software product development project for advancing disease research where critical health data is resident at multiple institutions across Canada. This project sits at the intersection of healthcare and artificial intelligence and is among the first of its kind globally.

Key responsibilities

Governance, Compliance & Privacy

• Serve as the primary security and compliance subject matter expert for DHDP.
• Lead and deliver the DHDP SOC 2 Type II certification program, from scoping and control implementation through external audit and certification.
• Develop and maintain the organization's security governance framework, policies, standards, and procedures.
• Provide security guidance to executive leadership, project teams, and partner organizations.
• Own compliance with Canadian health privacy and data protection requirements across jurisdictions, including PHIPA, Law 25, FIPPA, and PIPEDA.
• Monitor regulatory developments and recommend changes to controls, policies, and platform practices.
• Work collaboratively with hospitals, academic institutions, and industry partners to address compliance and security requirements while supporting successful platform adoption.

Security Architecture & Engineering

• Lead security architecture reviews across the DHDP technology ecosystem in conjunction with the DHDP engineering and product team.
• Review infrastructure-as-code implementations, IAM configurations, RBAC models, secrets management, and privileged access controls.
• Drive security practices across containerized workloads, CI/CD pipelines, cloud infrastructure, and application deployments.
• Work with the Data Scientist to define and maintain the security baseline for partner edge-node deployments.
• Define monitoring and logging requirements across the DHDP Azure environment.
• Lead risk assessments and support audit activities.
• Establish incident response processes, escalation pathways, and security event management procedures.
• Develop vulnerability management standards, remediation workflows, and risk tracking processes.
• Coordinate third-party assessments, penetration testing, and security reviews.
• Drive access cleanup, control improvements, and risk reduction initiatives during vendor and platform transitions.
• Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related discipline required.
• Minimum 7-10 years of progressive experience in cybersecurity, information security, privacy, compliance, or related disciplines.
• Professional designations such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor, or equivalent.
• Demonstrated experience operating as the primary or sole security leader within a small or scaling organization.
• Demonstrated experience leading a SOC 2 Type II program from planning and control design through certification.
• Experience working in health technology, research platforms, healthcare systems, or similarly regulated environments is an asset.
• Deep knowledge of Canadian privacy legislation, particularly within healthcare, research, or regulated data environments, including in Quebec.
• Excellent written and verbal communication skills with the ability to engage technical and non-technical audiences.
• Strong risk assessment, decision-making, and stakeholder management skills.
• Hands-on experience reviewing cloud infrastructure, infrastructure-as-code, IAM configurations, RBAC policies, and security architecture.
• Familiarity with OHDSI/OMOP, GA4GH standards, or related health research data ecosystems.
• Experience with federated or distributed data architectures where data residency remains at participating sites.
• Experience securing Microsoft Azure environments and cloud-native architectures.

Benefits of working with us

• Paid vacation
• Extended medical and dental coverage
• A work culture that values excellence, creativity, teamwork, learning, fairness and integrity
• A passionate group of high-performing teammates across Canada

We appreciate all applications, but only candidates selected for an interview will be contacted.

We recognize the importance of diversity and equity in our workforce and encourage all qualified applicants to apply, including Indigenous persons, women, persons with disabilities, minorities, and other underrepresented communities.