JOB INFORMATION

Requisition ID: 13561

Number of Vacancies: 1

Department: Information Technology Services - Cybersecurity Risk Management

Salary Information: $ 100,318.40 - $ 125,434.40

Pay Scale Group: 09SA

Employment Type: Regular - Hybrid

Vacancy: Existing

Weekly Hours: 35 Off Days: Saturday-Sunday Shift: Day

Posted On: August 21, 2026

Last Day to Apply: September 4, 2026

Reports to: Director, Cybersecurity Risk Management The Toronto Transit Commission (TTC), North America's third largest transit system and recognized as one of the top places to work in the GTA has introduced its new 2024-2028 TTC Corporate Plan - Moving Toronto, Connecting Communities which continues the TTC’s legacy of delivering service to hundreds of millions of customers a year. The TTC’s new vision and mission statements also help promote the many environmental, social equity and economic benefits that the TTC provides:

Vision: Moving Toronto towards a more equitable, sustainable, and prosperous future.

Mission: To serve the needs of transit riders by providing a safe, reliable, efficient, and accessible mass public transit service through a seamless integrated network to create access to opportunity for everyone.

Career Opportunity

Our Information Security Office is looking for a Cybersecurity Risk Specialist to play a critical role in reducing cybersecurity and information security risks across TTC. If you are passionate about If you are passionate about advancing cybersecurity through risk management, governance, and security culture, we encourage you to apply.

What You Will Do

Cybersecurity Risk Assessment & Mitigation: Conduct security and threat risk assessments, identify and monitor cybersecurity risks, maintain risk registers, and recommend risk mitigation strategies. Cybersecurity Maturity & Continuous Improvement: Assess cybersecurity capabilities against recognized frameworks and industry best practices and recommend improvements to strengthen the organization's security posture

Governance, Policies & Standards: Develop, implement, and maintain cybersecurity policies, standards, governance frameworks, and data classification requirements to support business and regulatory objectives.

Compliance & Control Assurance: Assess security controls, manage compliance and exceptions, identify control gaps, and coordinate remediation activities to ensure adherence to regulatory, legal, and organizational requirements.

Audit & Regulatory Coordination: Support internal and external audits, assessments, and regulatory reviews, ensuring timely responses, evidence collection, and resolution of findings.

Third-Party & Vendor Risk Management: Conduct vendor risk assessments and due diligence, review procurement and contract documentation for security and privacy requirements, monitor third-party risks throughout the vendor lifecycle, maintain vendor risk inventories, and communicate risk findings and recommendations to stakeholders.

Cybersecurity Program & GRC Management: Support cybersecurity programs, projects, and initiatives, and administer and enhance governance, risk, and compliance (GRC) tools, processes, and reporting capabilities.

Reporting & Stakeholder Engagement: Develop reports, metrics, and presentations; communicate cybersecurity risks and recommendations; and collaborate with technical and business stakeholders to support informed decision-making.

Security Resilience & Incident Preparedness: Support the development, testing, and continuous improvement of cybersecurity incident response, business continuity, and disaster recovery plans and procedures.

Security Awareness & Data Protection:



Promote cybersecurity awareness and secure practices across the organization, and support the enhancement of data protection capabilities, including Data Loss Prevention (DLP).

Cybersecurity Expertise & Continuous Improvement: Monitor emerging threats, technologies, and industry best practices, and serve as a subject matter expert on cybersecurity risk, governance, and compliance.

Promote a respectful work and service environment that supports diversity, inclusion, and is free from harassment and discrimination. Provide leadership in the development and implementation of inclusive and accessible policies, programs and/or services for employees and customers in accordance with TTC’s commitments and obligations under the Ontario Human Rights Code (OHRC) and Related Orders, the Accessibility for Ontarians with Disabilities Act (AODA), and TTC’s policies.

Participate in the TTC Ambassador Program.

What Skills Do You Bring?

- Demonstrate specialized expertise and knowledge in the assigned field
- Apply analytical skills
- Plan and organize activities / projects to meet section and organizational goals
- Communicate in a variety of mediums

What Qualifications Do You Bring?

- University degree in Computer Science, Information Security, Cybersecurity, or a related field as well as directly responsible working experience in Cybersecurity risk management or combination of education, training, and experience deemed to be equivalent
- Several years of relevant Cybersecurity experience in Governance, Risk and Compliance
- Several years of Information Technology experience in Microsoft and Linux platforms
- Experience with security frameworks (such as NIST CSF, ISO/IEC 27001/27002, and SOC2) and creation of policies, standards and procedures
- Experience with Privacy and Security requirements such as PHIPA, PIPEDA, MFIPPA, Canada’s antispam legislation (CASL), ISO IEC 27001, ISA IEC 62443, PCI DSS
- Experience in applicable information security management, governance, and compliance principles, practices, laws, rules and regulations
- Strong understanding of Information technology systems and processes, network infrastructure, data architecture, data processes, and protocols
- Excellent written & verbal communications skills (communicating at all levels with internal & external stakeholders) with fastidious attention to detail
- Strong decision-making capabilities, with a proven ability to weigh the relative costs and benefits of potential actions and identify the most appropriate one
- Strong analytical, problem-solving and troubleshooting skills
- An understanding of organizational mission, values, goals and consistent application of this knowledge
- Ability to work in a fast-paced environment managing multiple priorities with proven time management skills.

One of these certifications will be considered an asset:

- Certified in Risk and Information Systems Control (CRISC)
- Certified Information Systems Auditor (CISA)
- GIAC Systems and Network Auditor (GSNA)
- Certified Information Systems Security Skilled (CISSP)

What We Offer

- Commitment to creating a diverse, equitable and inclusive culture that promotes a sense of belonging and represents and reflects the needs of the communities we serve.




- One of the great benefits of being a full-time TTC employee is becoming a member of the TTC defined pension plan.
- A comprehensive package that covers health, dental, vision and more.
- Support for professional development opportunities for all colleagues through a broad range of learning programs that include in-person and online training, leadership development, and support for colleagues’ well-being.
- A flexible, hybrid work approach that allows colleagues to find balance between their professional and personal lives and making the most of the benefits of working remotely and purpose-driven in-person collaboration opportunities.

Commitment to EDI The TTC is committed to upholding the values of equity, diversity, anti-racism and inclusion in the delivery of its services and in its workplaces. The TTC is committed to fostering a diverse workforce that is representative of the communities it serves at all levels of the organization and supports an inclusive environment where diverse employee and community perspectives and experiences bring value to the organization. The TTC encourages applications from all applicants, including members of groups with historical and/or current barriers to equity, including but not limited to, Indigenous, Black and racialized groups, people with disabilities, women and people from the LGBTQIA+ community. The TTC values and supports an inclusive and barrier-free recruitment and selection process. Accommodations for applicants are available upon request throughout the recruitment and selection process, including for those who identify as having a disability.

Please contact Talent Management at (416) 393-4570 or [email protected] . Any information received related to an accommodation will be addressed confidentially.

General Prohibition in Hiring Process The TTC is also committed to a fair hiring process based on job related qualifications, merit, and abilities. You are expected to write your own materials and provide your own qualifications and experiences during the hiring process. The TTC will not tolerate the use of artificial intelligence or external resources in any of your submissions or responses, or the disclosure of interview questions to others.

By submitting your application, you acknowledge and agree to the following:

- The use of any artificial intelligence (AI) tool including, but not limited to, ChatGPT and Microsoft Copilot, to generate or produce any information or materials to be submitted or any response to any assessment question or any interview question, is prohibited.
- All information and materials you submit, including resume, cover letter, and assessment responses, are your own original work without the use of any AI tool
- During any interview, your response to any interview question is your own without the use or assistance of any AI tool or any person.
- You will not disseminate or disclose to any person any interview question.

Should you breach the prohibition of AI tool use, or information dissemination or disclosure, you will be in violation of TTC’s hiring process and TTC may withdraw your application and may prohibit you from participation in the TTC hiring process. Relatives of TTC Employees The TTC’s policy prohibits relatives of current TTC employees from being hired, assigned, transferred or promoted into positions, where there is a conflict of interest due to a relationship. Should you be selected for an interview, you will be required to disclose the name, relationship and position of any relative who is a current TTC employee.

We thank all applicants for their interest but advise only those selected for an interview will be contacted.

📌 Cybersecurity Risk Specialist (Toronto)
🏢 TTC (Toronto Transit Commission)
📍 Toronto