Senior Security Specialist - Threat Risk Assessment (TRA)

Client: Supply Ontario | RQ00742 (Hybrid, Toronto, ON, Canada)

We are hiring a

Senior Security Specialist

to lead enterprise

Threat Risk Assessment (TRA)

initiatives for

Supply Ontario , supporting the assessment and enhancement of security across applications, infrastructure, business processes, and information systems. The ideal candidate will have extensive experience in

risk management frameworks, threat modeling, information security governance, compliance, and executive-level security reporting .

This prospect is best suited for cybersecurity professionals with proven expertise in

ISO 31000, NIST RMF, FAIR, STRIDE, PASTA, MITRE ATT&CK;, ISO 27001, NIST CSF, CIS Controls , and regulatory compliance within complex enterprise or public sector environments.

Role Snapshot

Requisition ID

RQ00742

Job Title

Senior Security Specialist

Client

Supply Ontario

Work Location

525 University Avenue, Toronto, Ontario, Canada

Work Arrangement

Hybrid (Up to 3 days onsite at Hiring Manager's discretion)

Start Date

September 1, 2026

End Date

March 31, 2027

Duration

151 Business Days

Work Schedule

7.25 Hours per Day (5 Days/Week)

Industry

Public Sector

Public Sector Experience

Preferred

Position Overview

Supply Ontario is seeking a

Senior Security Specialist

to drive the end-to-end execution of

Threat Risk Assessments (TRA)

across enterprise systems, applications, infrastructure, and business processes. The successful consultant will identify threats, evaluate vulnerabilities, assess organizational risk, and recommend effective mitigation strategies while ensuring compliance with industry standards and regulatory requirements.

The role requires collaboration with technical teams, business stakeholders, and executive leadership to strengthen the organization's overall cybersecurity posture and support strategic security initiatives.

Key Responsibilities

Threat Risk Assessment & Risk Management (40%)

Lead comprehensive Threat Risk Assessment (TRA) engagements across enterprise environments

Define assessment scope with business and technical stakeholders

Conduct structured risk assessments using recognized frameworks, including:

ISO 31000

NIST Risk Management Framework (RMF)

FAIR (Factor Analysis of Information Risk)

Identify, evaluate,



and prioritize threats, vulnerabilities, and organizational risks

Maintain enterprise risk registers and monitor remediation activities

Develop practical mitigation strategies aligned with business objectives

Threat Modeling & Security Analysis (30%)

Develop and apply threat models using methodologies such as:

STRIDE

PASTA

MITRE ATT&CK;

Review system architecture, application designs, and data flows

Identify attack surfaces, threat vectors, and security weaknesses

Perform security gap analysis against industry standards and best practices

Assess confidentiality, integrity, and availability (CIA) risks across enterprise environments

Security Governance, Compliance & Reporting (20%)

Ensure alignment with organizational security policies and regulatory requirements

Support compliance initiatives involving:

ISO 27001

NIST Cybersecurity Framework (CSF)

CIS Critical Security Controls

PHIPA (Personal Health Information Protection Act)

Produce comprehensive TRA reports, executive summaries, and compliance documentation

Present findings, risk ratings, and remediation recommendations to executive leadership

Support internal audits and security governance initiatives

Continuous Security Improvement (10%)

Contribute to the evolution of enterprise risk management methodologies

Monitor emerging cyber threats, vulnerabilities, and security trends

Recommend improvements to organizational security controls and governance practices

Collaborate across cross-functional teams to strengthen enterprise security capabilities

Required Skills & Experience

Skill / Experience Required Experience Threat Risk Assessments (TRA) 5-7 Years ISO 31000 Risk Management 5-7 Years NIST RMF 5-7 Years FAIR Risk Framework 5-7 Years Threat Modeling (STRIDE, PASTA, MITRE ATT&CK;)



3-5 Years Security Governance 5+ Years ISO 27001 5+ Years NIST CSF 5+ Years CIS Critical Security Controls 5+ Years Risk Registers & Risk Reporting 5+ Years Executive & Technical Reporting 5+ Years Gap Analysis Required Risk Assessment Matrices Required Data Flow Diagrams Required Vulnerability Analysis Required Stakeholder Communication Required Regulatory Compliance (PHIPA) Required

Highly Desired Skills

Enterprise security architecture assessments

Security control maturity assessments

Attack surface analysis

Asset inventory and classification

Vulnerability assessment tools (e.g., Nessus, OpenVAS)

Executive-level cybersecurity presentations

Security audit support

Risk treatment planning

Cybersecurity policy development

Public sector security experience

Deliverables

The Selected Consultant Will Be Responsible For Delivering

Comprehensive Threat Risk Assessment (TRA) Reports

Enterprise Risk Registers

Threat Modeling Diagrams

Risk Assessment Matrices

Asset Inventory & Classification Documentation

Vulnerability Assessment Reports

Security Gap Analysis

Mitigation & Remediation Plans

Executive Summary Reports

Compliance Mapping Documentation

Executive Presentation Decks

Evaluation Criteria

Category Weight Threat Modeling (STRIDE, PASTA, MITRE ATT&CK;) 20% Threat Risk Assessment (ISO 31000, NIST RMF, FAIR) 20% Security Gap Analysis & Architecture 20% Collaboration, Communication & Teamwork 30% Executive Reporting & Presentations 10%

Additional Assignment Information

Hybrid work arrangement with onsite attendance (up to 3 days per week) as required by the Hiring Manager

Agency-issued laptop will be provided

Consultant must maintain a secure home office with hard-wired internet connectivity

Agency systems and equipment must remain within the Province of Ontario unless prior written approval is obtained

Assignment duration is 151 business days, with the possibility of extension based on project needs and Agency discretion

Know someone who may be a good fit?

Feel free to share this opportunity with experienced

Senior Security Specialists, Cybersecurity Consultants, Information Security Analysts, Security Architects, Risk & Compliance Consultants, and Threat Risk Assessment (TRA) professionals

with expertise in

ISO 31000, NIST RMF, FAIR, STRIDE, PASTA, MITRE ATT&CK;, ISO 27001, NIST CSF, CIS Controls, PHIPA compliance, enterprise security governance, and public sector cybersecurity initiatives .

#J-18808-Ljbffr

📌 Security Specialist - Senior (Winnipeg)
🏢 S M Software Solutions
📍 Winnipeg