Senior Cyber Risk & GRC Strategist

Hydro One; Toronto; On-site; CAD 101,000 - 131,000; Full time

Job summary

Hydro One is seeking a Senior Cybersecurity Specialist, GRC Risk Management to lead cyber risk management across IT, OT, cloud, and emerging tech. You will partner with business, technology, compliance, and security architecture to identify, assess, and mitigate risks, ensuring regulatory and security compliance.

You will drive governance activities, risk reporting, control testing, and risk treatment planning, while leveraging security engineering to modernize GRC processes and improve risk

Qualifications

• Over 10 years of information security experience in risk management and information security.
• Deep knowledge of NIST SP800-53 and NIST CSF.
• Experience as an advisor/consultant representing Information Security.
• Post-secondary education in CS or related field; relevant certifications would be an asset.

Responsibilities

• Represent the Cyber Risk Management team as an advisor to support the overall security program.
• Lead cyber risk assessments, governance and compliance activities.
• Provide risk-based guidance for technology initiatives and architecture decisions.
• Collaborate with executives and stakeholders to communicate risk insights for decision-making.
• Support NERC CIP compliance and regulatory inquiries.

Skills

Cybersecurity governance

Risk management

NIST SP800-53 / CSF

Communication

Executive reporting

Stakeholder management

Education

Post-secondary education in Computer Science or related field

CISSP/CRISC/CISM or similar certification asset

Job description

Hydro One is seeking a Senior Cybersecurity Specialist, GRC Risk Management to lead cyber risk management across IT, OT, cloud, and emerging tech. You will partner with business, technology, compliance, and security architecture to identify, assess, and mitigate risks, ensuring regulatory and security compliance.

You will drive governance activities, risk reporting, control testing, and risk treatment planning, while leveraging security engineering to modernize GRC processes and improve risk