Security Compliance Lead

Security Compliance Lead

Location : Ottawa/Toronto, On-Site

Reports to: Head of Security

The Role

In this role, you'll lead our CPCSC certification program from the ground up — owning the controls register, evidence collection, and assessor relationship to drive us through Level 1 and Level 2 audit readiness. Beyond certification, you'll build out third-party risk assessments, manage the Controlled Goods Program and export-control obligations, oversee security flow-downs on federal/defence contracts, and run the company's security awareness training and policy governance.

What You'll Own

You won’t build all of this on day one. We’ll sequence it together, starting with CPCSC and adding scope as the program matures. A credible, evidenced path to CPCSC certification underway; vendors assessed and tracked with flow-downs enforced; Controlled Goods and clearance baked into how we operate; a real, maintained policy suite where there’s tribal knowledge today; and a live training program with evidence behind it.

• Own the CPCSC controls program (ITSP.10.171) and drive certification with the Head of Security — your first and biggest focus. CPCSC is Canada’s new defence cyber-certification; you don’t need to have done it before.

• Stand up third-party & supply-chain risk — vendor due diligence, scoring, and security requirement flow-downs to suppliers and partners.

• Run the Controlled Goods Program and export-control obligations as they come into scope.

• Handle contract security on government & defence work — security flow-downs, clearance administration, and controlled-information handling.

• Turn today’s tribal knowledge into a maintained policy suite and a live security-awareness program.

• Note on legal: you own the security requirements inside contracts. Commercial, corporate, and IP legal sits with Legal / outside counsel — you partner with them, you don’t carry it.

What You Bring

• Experience building or running a security compliance program against a recognized framework — ISO 27001, SOC 2, NIST SP 800-171, CMMC, or a comparable. You do not need prior CPCSC experience — If you can run a program against one of these, you can learn CPCSC, and we’ll back you while you do.

• Fluency in a controls framework: you can read a control, design evidence for it, and defend it to an assessor.

• A builder’s temperament — you’d rather stand up the function than inherit a mature one, and you’re comfortable with ambiguity.

• Nice to Have (Genuinely Optional): Direct CPCSC/CMMC experience · Controlled Goods and export-control familiarity (EIPA, ITAR/EAR) · relevant certs (CISA, CISSP, ISO 27001 Lead Implementer/Auditor) · bilingual (English/French) · defence / startup / scale-up background.

No defence background required.

We've hired people who didn't tick every box. If this is the work you want to do, please apply anyway.

 

Why Join Us

Building something meaningful starts with the right people. At Dominion Dynamics, you’ll:

• Shape Canada’s future by building real defence capability for the CAF and our allies.

• Make decisions that ship in a high-trust environment with short feedback loops and rapid iteration.

• Move fast, field faster, and work directly with the operator — our systems are in the field with the CAF now.

• Have an impact from day one with equity, responsibility, and direct access to leadership.

If you’re curious, hands-on, and driven by the opportunity to make a difference, this is where you belong!

 

Compensation & Benefits

• Competitive base salary and company equity

• Comprehensive health benefits

• Additional equity granted based on impact

We use AI tools to support parts of the hiring process, including screening and reviewing responses. Final hiring decisions are always made by people and follow all applicable privacy and employment laws in Canada.