Senior Security Specialist - Threat Risk Assessment (TRA)Client: Supply Ontario | RQ00742 (Hybrid, Toronto, ON, Canada)We are hiring a Senior Security Specialist to lead enterprise Threat Risk Assessment (TRA) initiatives for Supply Ontario, supporting the assessment and enhancement of security across applications, infrastructure, business processes, and information systems. The ideal candidate will have extensive experience in risk management frameworks, threat modeling, information security governance, compliance, and executive-level security reporting.This chance is best suited for cybersecurity professionals with proven expertise in ISO 31000, NIST RMF, FAIR, STRIDE, PASTA, MITRE ATT&CK, ISO 27001, NIST CSF, CIS Controls, and regulatory compliance within complex enterprise or public sector environments.Role SnapshotRequisition ID RQ00742 Job Title Senior Security Specialist Client Supply Ontario Work Location 525 University Avenue, Toronto, Ontario, Canada Work Arrangement Hybrid (Up to 3 days onsite at Hiring Manager's discretion) Start Date September 1, 2026 End Date March 31, 2027 Duration 151 Business Days Work Schedule 7.25 Hours per Day (5 Days/Week) Industry Public Sector Public Sector Experience PreferredPosition OverviewSupply Ontario is seeking a Senior Security Specialist to drive the end-to-end execution of Threat Risk Assessments (TRA) across enterprise systems, applications, infrastructure, and business processes. The successful consultant will identify threats, evaluate vulnerabilities, assess organizational risk, and recommend effective mitigation strategies while ensuring compliance with industry standards and regulatory requirements.The role requires collaboration with technical teams, business stakeholders, and executive leadership to strengthen the organization's overall cybersecurity posture and support strategic security initiatives.Key ResponsibilitiesThreat Risk Assessment & Risk Management (40%)Lead comprehensive Threat Risk Assessment (TRA) engagements across enterprise environmentsDefine assessment scope with business and technical stakeholdersConduct structured risk assessments using recognized frameworks, including:ISO 31000NIST Risk Management Framework (RMF)FAIR (Factor Analysis of Information Risk)Identify, evaluate, and prioritize threats,



vulnerabilities, and organizational risksMaintain enterprise risk registers and monitor remediation activitiesDevelop practical mitigation strategies aligned with business objectivesThreat Modeling & Security Analysis (30%)Develop and apply threat models using methodologies such as:STRIDEPASTAMITRE ATT&CKReview system architecture, application designs, and data flowsIdentify attack surfaces, threat vectors, and security weaknessesPerform security gap analysis against industry standards and best practicesAssess confidentiality, integrity, and availability (CIA) risks across enterprise environmentsSecurity Governance, Compliance & Reporting (20%)Ensure alignment with organizational security policies and regulatory requirementsSupport compliance initiatives involving:ISO 27001NIST Cybersecurity Framework (CSF)CIS Critical Security ControlsPHIPA (Personal Health Information Protection Act)Produce comprehensive TRA reports, executive summaries, and compliance documentationPresent findings, risk ratings, and remediation recommendations to executive leadershipSupport internal audits and security governance initiativesContinuous Security Improvement (10%)Contribute to the evolution of enterprise risk management methodologiesMonitor emerging cyber threats, vulnerabilities, and security trendsRecommend improvements to organizational security controls and governance practicesCollaborate across cross-functional teams to strengthen enterprise security capabilitiesRequired Skills & ExperienceSkill / Experience Required Experience Threat Risk Assessments (TRA) 5-7 Years ISO 31000 Risk Management 5-7 Years NIST RMF 5-7 Years FAIR Risk Framework 5-7 Years Threat Modeling (STRIDE, PASTA, MITRE ATT&CK)



3-5 Years Security Governance 5+ Years ISO 27001 5+ Years NIST CSF 5+ Years CIS Critical Security Controls 5+ Years Risk Registers & Risk Reporting 5+ Years Executive & Technical Reporting 5+ Years Gap Analysis Required Risk Assessment Matrices Required Data Flow Diagrams Required Vulnerability Analysis Required Stakeholder Communication Required Regulatory Compliance (PHIPA) RequiredHighly Desired SkillsEnterprise security architecture assessmentsSecurity control maturity assessmentsAttack surface analysisAsset inventory and classificationVulnerability assessment tools (e.G., Nessus, OpenVAS)Executive-level cybersecurity presentationsSecurity audit supportRisk treatment planningCybersecurity policy developmentPublic sector security experienceDeliverablesThe Selected Consultant Will Be Responsible For DeliveringComprehensive Threat Risk Assessment (TRA) ReportsEnterprise Risk RegistersThreat Modeling DiagramsRisk Assessment MatricesAsset Inventory & Classification DocumentationVulnerability Assessment ReportsSecurity Gap AnalysisMitigation & Remediation PlansExecutive Summary ReportsCompliance Mapping DocumentationExecutive Presentation DecksEvaluation CriteriaCategory Weight Threat Modeling (STRIDE, PASTA, MITRE ATT&CK) 20% Threat Risk Assessment (ISO 31000, NIST RMF, FAIR) 20% Security Gap Analysis & Architecture 20% Collaboration, Communication & Teamwork 30% Executive Reporting & Presentations 10%Additional Assignment InformationHybrid work arrangement with onsite attendance (up to 3 days per week) as required by the Hiring ManagerAgency-issued laptop will be providedConsultant must maintain a secure home office with hard-wired internet connectivityAgency systems and equipment must remain within the Province of Ontario unless prior written approval is obtainedAssignment duration is 151 business days, with the possibility of extension based on project needs and Agency discretionKnow someone who may be a good fit?Feel free to share this opportunity with experienced Senior Security Specialists, Cybersecurity Consultants, Information Security Analysts, Security Architects, Risk & Compliance Consultants, and Threat Risk Assessment (TRA) professionals with expertise in ISO 31000, NIST RMF, FAIR, STRIDE, PASTA, MITRE ATT&CK, ISO 27001, NIST CSF, CIS Controls, PHIPA compliance, enterprise security governance, and public sector cybersecurity initiatives.#J-18808-Ljbffr

📌 Rq00742 - Security Specialist - Senior (Toronto)
🏢 S M Software Solutions
📍 Toronto