At EY, we’re all in to shape your future with confidence. We’ll help you succeed in a globally connected powerhouse of diverse teams and take your career wherever you want it to go. Join EY and help to build a better working world.

The opportunity

The Senior Consultant will work with large, complex organizations to evaluate how effectively cybersecurity capabilities are designed, implemented, governed, measured, automated, and sustained. The role is broader than compliance mapping or control testing. It requires the ability to understand how people, process, technology, governance, and risk considerations work together across an enterprise cybersecurity program.

This job posting relates to an existing vacancy within our organization.

Key Responsibilities

- Own assigned cybersecurity domains through assessment planning, artifact requests, document review, stakeholder workshops, maturity analysis, quality review, and reporting.
- Translate framework outcomes and other industry guidance into practical, capability-based assessment criteria appropriate to the client environment.
- Review policies, standards, procedures, operating models, architectures, inventories, metrics, reports, and technical documentation to understand the current state.
- Plan and facilitate interviews and workshops with cybersecurity leaders, architects, engineers, risk teams, and control or capability owners.
- Ask targeted follow‑up questions, appropriately challenge unsupported statements, and identify where further validation is required.
- Synthesize stakeholder input, artifacts, metrics, and technical context into consistent and defensible maturity conclusions.
- Draft concise current‑state observations, maturity rationales, opportunities for improvement,



risk implications, and practical recommendations.
- Connect detailed domain findings to broader themes, business impacts, target‑state considerations, and prioritized improvement actions.
- Prepare transparent, executive‑ready materials and support presentations to client leadership.
- Guide Consultants, review draft analyses and workpapers, maintain consistency across domains, and elevate issues early.
- Contribute to the refinement of assessment methodologies, capability libraries, reporting approaches, and reusable intellectual property.

To qualify for the role you must have

- Hands‑on experience delivering cybersecurity maturity, capability, risk, controls, assurance, or transformation assessments.
- Demonstrated ability to independently lead a workstream or assessment domain from information gathering through final reporting.
- Working knowledge of common cyber and IT frameworks, with the ability to explain how framework outcomes apply to real cybersecurity capabilities and operating environments.
- Broad understanding across multiple cybersecurity domains, with meaningful depth in at least two or three areas.
- Experience facilitating stakeholder interviews or workshops and communicating with both technical practitioners and senior leaders.
- Strong analytical judgment,



including the ability to form supportable conclusions from incomplete, varied, or conflicting information.
- Excellent written communication skills, including findings, recommendations, presentations, and executive summaries.
- Ability to manage multiple domains, stakeholders, and deliverables while maintaining quality and consistency.
- Experience coaching junior team members and reviewing their work.

Ideally, you’ll also have

- Experience applying NIST CSF 2.0, including Functions, Categories, Subcategories, Current Profiles, and Target Profiles.
- Familiarity with NIST SP 800‑53, CIS Controls, ISO/IEC 27001 and 27002, COBIT, CRI Profile, CSA CCM, or related cyber‑risk frameworks.
- Experience in banking, insurance, payments, or another highly regulated and federated enterprise environment.
- Familiarity with Canadian financial‑services expectations such as OSFI B‑13 or other relevant regulatory guidance.
- Experience developing maturity models, target states, cyber roadmaps, benchmarking insights, or transformation recommendations.
- Relevant cybersecurity or risk certification such as CISSP, CISM, CRISC, CISA, ISO 27001, CCSP, or equivalent credential. Certifications are considered supporting qualifications rather than a substitute for practical delivery experience.

Cybersecurity domain coverage

Candidates are not expected to be specialists in every domain. The strongest profiles will demonstrate depth in selected areas and working fluency across several others.

Governance and risk

Cyber governance, policy and standards, security metrics, second‑line cyber risk, third‑party risk, privacy

Identity and data

IAM, PAM, customer identity, data p

📌 Cybersecurity - Financial Services (FSO) - Senior Consultant (Montreal)
🏢 EY
📍 Montreal