Senior InfoSec: Third-Party Risk & Data Breach Expert (Hybrid)

CBC/Radio-Canada; Toronto; Hybrid; CAD 120,000 - 160,000; Full time

Job summary

CBC/Radio-Canada is seeking a Senior Information Security Analyst, Third-Party Security and Data Breach Expert, to spearhead its TPRM program for external partners and vendors. You will oversee ongoing assessments to keep vendor risks within acceptable limits while ensuring regulatory and organizational compliance.

You will report risk posture to governance committees and advise on GRC across the organization. This hybrid role can be based in Montreal or Toronto.

Qualifications

• 5+ years in IT risk governance and TPRM with at least 3 years in information security.
• Strong knowledge of security standards and risk assessment methods.
• Able to negotiate contractual security/privacy requirements with legal teams.
• Excellent written and verbal communication for governance committees.
• Bilingual English/French required.
• Security certifications (CISSP/CISM/CISA) are a plus.

Responsibilities

• Lead and oversee the organization-wide Third-Party Risk Management program.
• Define risk classification frameworks and assessment questionnaires.
• Evaluate security posture using SOC 2 Type II, ISO 27001, audits.
• Develop remediation plans and work with vendors to close gaps.
• Maintain third-party risk registers and report KPIs to leadership.

Skills

IT risk governance

Third-Party Risk

Information security

Vendor risk assessment

Regulatory compliance

GRC communication

Education

University degree in computer science/IT/InfoSec

Tools

ISO/IEC 27001

NIST SP 800-53

Cloud security

Job description

CBC/Radio-Canada is seeking a Senior Information Security Analyst, Third-Party Security and Data Breach Expert, to spearhead its TPRM program for external partners and vendors. You will oversee ongoing assessments to keep vendor risks within acceptable limits while ensuring regulatory and organizational compliance.

You will report risk posture to governance committees and advise on GRC across the organization. This hybrid role can be based in Montreal or Toronto.