Cyber Risk Consultant

Job Responsibility:

Cyber Risk Consultant

We're looking for a talented Cyber Risk Consultant to grow our team. If your passion lies in understanding and navigating the complex landscape of cyber threats through a lens of advanced risk assessment and mitigation strategies, we have an excellent opportunity for you.

As a key member of our team, you will be actively involved in conducting risk, privacy, and cybersecurity assessments, assisting our high-profile clients in identifying risks, enhancing their security posture, and developing robust strategies to mitigate potential cyber threats.

We believe in fostering a culture of continuous learning and professional development, providing opportunities for you to expand your expertise in cybersecurity, privacy, and risk management. Together, we will tackle challenging projects, innovate solutions, and achieve excellence in our field, ensuring that as our team grows, you do too.

Key Responsibilities:

· Conduct information security gap, maturity, and threat risk assessments (e.g., NIST CSF, HITRUST CSF, CIS CSC, etc.).

· Collect information security control evidence from third-party vendors to facilitate the process of conducting third-party risk assessments for our clients.

· Conduct in-depth analysis of business, financial, and IT systems, alongside other data processing systems, to identify technology and privacy risks and provide recommendations for improvements and risk treatment.

· Develop professional reports, providing comprehensive insights into assessment findings, detailed risk information, and expert advice on remediation or risk reduction and treatment strategies.

· Assist in the co-ordination and documentation of the IT risk control libraries for third-party and threat risk assessments.

· Work collaboratively with the team to strategize engagements, formulate project timelines and requirements, conduct needs analysis, and provide support for other project planning activities.

· Maintain up-to-date knowledge of security threats, industry trends, GRC tools, processes, and technologies.

· Travel to company offices and client locations across Canada.

Technical Skills:

· Good understanding of risk management principles and frameworks, such as the NIST RMF, ISF, ISO 27005 and their application to diverse technology environments. Additional experience in one or more of the following: SIG, FAIR, or STRIDE would be an asset.

· Good understanding of and hands-on experience in risk management disciplines, such as IT risk, internal audit, general IT controls, and SOC 2 assessments.

· Good understanding of cloud service provider security frameworks and configuration best practices such as AWS Shared Responsibility Model, Azure Security Benchmarks, CSA CCM, etc.

· Good understanding of industry regulations and standards, such as NIST SP 800-53, NIST CSF, ISO 27001, HITRUST CSF, CIS benchmarks, etc.

· Knowledge of emerging attacker trends, attack methodologies, and response techniques to ensure robust and up-to-date security measures would be an asset.

· Knowledge and experience working with SOC audit reports.

· Good understanding of various information security concepts, including; network and wireless security, application security, industry best practices, systems hardening, data encryption, data privacy, incident response, physical security, vulnerability scanning, penetration testing, file integrity monitoring, log monitoring, and documented security governance controls (i.e. policies, processes, standards, procedures).

· Good understanding of network systems configurations, Unix, Linux, Windows, Cloud native and database server configurations.

Education and Work Experience:

· Degree in Information Technology, Information Systems, Information Security, or Risk Management (or equivalent work experience).

· Minimum 4 years of professional experience in cybersecurity, with a focus on risk assessment, security controls, and/or compliance.

Industry Certifications:

· Willingness to obtain industry certifications (e.g., CISSP, CRISC, CIPM, CIPT, HITRUST CCSFP, etc.).

· Industry certification in Information Security/Audit is an asset.

Soft Skills:

· Exceptional customer service, communication and interpersonal skills

· Strong written and verbal communication skills.

· Strong organizational skills

· Strong time management skills

· Honesty and integrity

· Dedication to providing solutions to meet or exceed client's needs and expectations

· Ability to handle challenges and project work loads

Benefits:

· Company paid medical and dental benefits and wellness benefits

· Company paid continuing professional education and certification maintenance

· RRSP contribution

· 4 weeks of paid vacation, with 5 weeks of paid vacation after 5 years of service

· Company team building events throughout each year

· Control Gap offers custom-built state of the art tools and a proven processes that allows our assessors to be comfortable, efficient, and organized while providing excellent audit quality.

· Flexible remote work options

Location:

· You must be located within reasonable travelling distance of the Control Gap Headquarters in Mississauga, Ontario, Canada.

· You must possess reliable transportation to travel to company offices and to client work sites.

Employment Type:

· Full-time

Job Type: Full-time