Security Specialist

Location: Toronto, ON

Onsite Flexibility: Hybrid — 2 days in office, 3 days work from home (potential to go to 5 days per week)

Contract Details

- Position Type: Contract
- Contract Duration: 12 months (with possibility of extension based on business needs and performance; conversion to permanent also possible based on business needs and performance)
- Pay Rate: C$90.00–C$108.00 / Hour (CAD)
- Shift / Schedule: Monday–Friday, core business hours — 37.5 hours per week, 7.5 hours per day; overtime possible
- Travel Requirements: Not required

Job Summary

This role supports Technology Controls Governance & Reporting within a large financial institution's GRC (Governance, Risk & Controls) team. The team manages technology issues throughout the issue management lifecycle — including regulatory issues, 1st, 2nd, and 3rd line of defense, audit compliance issues, data analytics, and automation. The team's focus is governance of technology issues and technology controls, governing the process to ensure issues stay on track; they sit above the remediation layer and escalate up or down as needed.

Two positions are being filled, both focused on Technology Governance, Risk & Controls / Issue Management. One role has more regulatory-focused issues; the other focuses on 1st, 2nd, and 3rd line of defense issues. The team does not perform the technical remediation or control testing themselves — their job is to govern the technology issue-management lifecycle, track issues and findings through remediation, monitor deadlines, milestones, and progress, identify and escalate blockers, provide executive visibility and reporting, prepare initial drafts/templates for regulatory communications, ensure issues stay on track through governance, and think of issues as tickets requiring remediation while overseeing the process rather than doing the technical fix.

The day-to-day involves 3 to 4 hours in meetings to collect status and collaborate, then 2 to 3 hours performing governance activities and BAU work — providing updates and creating reports. There can be frequent "fire drills" because the GRC process is still being matured. Executives may request information ad hoc and quickly, so candidates need to be able to retrieve and summarize status rapidly. Banking experience is NOT mandatory — skills are considered transferable across industries.

Key Responsibilities

- Govern the technology issue-management lifecycle
- Track issues and findings through remediation
- Monitor deadlines, milestones, and progress
- Identify and escalate blockers
- Provide executive visibility and reporting
- Prepare initial drafts/templates for regulatory communications
- Ensure issues stay on track through governance
- Manage technology issues throughout the issue management lifecycle — regulatory issues, 1st/2nd/3rd line of defense,



audit compliance issues, data analytics, and automation
- Collect status updates, collaborate with stakeholders, and perform governance activities
- Provide updates and create reports for executive-level audiences
- Draft communications intended for regulators (candidate will not be communicating directly with regulators)
- Respond rapidly to ad hoc requests from executives, retrieving and summarizing status quickly
- Work on tickets to support issue remediation governance (team manages issues and works on tickets; they do not perform the technical fix)
- Oversee project governance for regulatory exam findings (Project 1) and technology issues management program (Project 2)

Required Skills

- 10 years of regulatory exam findings, internal audits, technology issues management, or Technology GRC experience
- Microsoft Suite — PowerPoint, Word, Excel, Visio
- Previous control testing and audit experience
- Ability to write reporting intended for executive level
- Strong communication skills — verbal and written
- Solid critical thinking skills
- Strong attention to detail, proactive, organized
- Ability to work independently and collaborate in a team environment
- Understanding of the lifecycle process of issue remediation and technology controls remediation
- Understanding of what a control is, what an issue is, industry standards, and toll gates
- Good organizational / project management skills to stay on top of multiple concurrent issues
- Ability to analyze data
- Experience with ServiceNow AGRC module, PowerBI for reporting, SharePoint, Confluence, Excel (including Macros), and Access

Preferred Skills

- Governance, Risk and Controls (GRC) experience
- Big 4 consulting firm experience
- Alteryx, Power BI, Tableau, or any other automation tools for reporting
- CISA and CRISC certifications or equivalent (strongly preferred for the issues management project)
- CISA/CISSP-type certifications (can be beneficial, but strong relevant experience can compensate; certification is not the primary selection factor)
- Strong transferable backgrounds from: Internal Audit, Technology Risk Management, GRC, Control Testing or Control-Testing Oversight/Review, Control Design, Issue Management/Remediation Governance, First/Second/Third Line of Defense, Big 4 Consulting, Technology Governance, Strong Project/Program Management experience

Education Requirements

- Post-secondary education required; certifications are an asset




- CISA and CRISC certifications or equivalent strongly preferred for the issues management project
- CISA/CISSP-type certifications beneficial; strong relevant experience can compensate

Required Experience

- 10 years of experience in regulatory exams and findings, internal audits, technology issues management, or Technology GRC (10 years preferred but flexible if the candidate has strong relevant experience)
- Background in Internal Audit with Technology Controls — knowledge of control testing and writing background
- Experience communicating with and presenting to senior stakeholders and executives

Work Environment / Physical Requirements

- Hybrid schedule: 2 days on-site, 3 days work from home (potential to go to 5 days per week on-site)
- Anchor days follow the team's schedule
- Approximately 3–4 hours per day in meetings (internal stakeholders only; no access to customer data)
- Frequent "fire drills" due to a GRC process still being matured; ability to handle fast-paced, ad hoc executive requests required
- Rotation: No

Important Notes

- Two positions are being filled; please indicate in your submission whether you feel your candidate is a stronger fit for the regulatory-focused role or the 1st/2nd/3rd line of defense role (or strong for both).
- Interview process: 2 rounds — first with the manager, second with the team lead (approximately 30 minutes each).
- Candidates with a pattern of job hopping or multiple short-term positions may be disqualified from consideration.
- Candidates who are former TD contractors (via SOW), have worked at TD in any capacity, or have worked at TD as a full-time employee must be disclosed.

About the Client

This client is one of North America's largest financial institutions — the sixth-largest bank on the continent by branches — serving approximately 22 million customers across Canada, the United States, Europe, and the Asia-Pacific region. Headquartered in Toronto, Ontario, the organization operates a full-service financial platform spanning personal and commercial banking, wealth management, insurance, and payment solutions, delivered through a team of over 85,000 employees worldwide. Teams here span retail banking advisors, commercial lenders, wealth management professionals, risk analysts, and technology specialists, all working within a culture described as respectful, team-oriented, and built around inclusion and the unique contributions of every individual.

About GTT

GTT is a minority-owned staffing firm and a subsidiary of Chenega Corporation, a Native American-owned company in Alaska. We highly value diverse and inclusive workplaces and support Fortune 500 organizations across banking, financial services, technology, life sciences, biotech, utilities, and retail sectors throughout the U.S. and Canada.

Job Number: 26-14818

#gttca

📌 Security Specialist (Toronto)
🏢 The Client
📍 Toronto