Cassels Brock & Blackwell LLP is a leading national law firm serving the transaction, advocacy, and advisory needs of clients across Canada’s most dynamic industries. From offices in Toronto, Vancouver, and Calgary, our litigators act on complex commercial disputes for multinational, national, and mid-market clients. We combine rigorous advocacy with practical judgment, inventive strategy, and an unwavering focus on achieving productive, business-minded outcomes.

Our Culture:

At Cassels, our mission is to attract, retain and promote individuals of exceptional ability and talent from as broad a range of backgrounds as possible. We offer meaningful career opportunities, invest in professional growth, and foster an inclusive environment. Our Firm’s success is built on the unique skills, perspectives, experiences and values of each individual. We encourage a corporate culture that respects and celebrates the dignity, value and diversity of all.

Role Overview:

Cassels is seeking a Senior Information Security, GRC Analyst in our Information Technology department, reporting to the Assistant Director, Information Security. This role provides governance, risk, compliance, assurance, and security advisory support across the Firm's information security program. The role conducts security risk and control assessments for IT projects, systems, applications, cloud services, integrations, and material technology changes; provides security advisory services to technology and business stakeholders; maintains ISMS documentation and evidence; coordinates client, audit, and assessment responses; manages third-party security risk activities; and helps ensure that security risks, control gaps, exceptions, and remediation activities are identified, documented, tracked,



and reported.

The successful candidate will be responsible for:

- Establishing and maintaining processes for the collection, validation, organization, and retention of evidence required to demonstrate compliance with security, regulatory, contractual, client, and ISMS requirements.
- Monitoring and reporting on remediation activities related to security findings, audit observations, risk treatment plans, policy exceptions, control deficiencies, and technology issues, escalating overdue or high-risk items as appropriate.
- Conducting security risk and control assessments for IT projects, systems, applications, cloud services, integrations, and material technology changes, providing practical security guidance throughout the project lifecycle.
- Maintaining and enhancing the Firm's threat catalogue, ensuring threats remain relevant, accurately described, and appropriately mapped to organizational assets, risk assessments, and security controls.
- Reviewing proposed technology solutions, integrations, configurations, and changes to identify security risks, control gaps, and opportunities to improve the Firm’s security posture.
- Reviewing and assessing security configuration baselines, build standards, and supporting documentation maintained by IT teams to identify security risks, control gaps, and deviations from Firm security requirements.




- Participating in the change management process by assessing the security impact of proposed changes and advising on required controls, approvals, testing, documentation, and risk treatment.
- Supporting security incident management by ensuring incidents are documented, corrective actions are tracked, control gaps are identified, and post-incident lessons learned are incorporated into the ISMS, risk register, and control improvement activities.
- Coordinating client security assessments, questionnaires, audits, and assurance activities by gathering and validating security information, coordinating evidence collection, tracking findings and remediation activities, and maintaining audit readiness.
- Performing security due diligence and risk assessments of third-party vendors, service providers, and cloud services, documenting findings and recommending appropriate risk treatment actions.
- Providing operational security support where required.

The successful candidate must have the following education, experience and/or demonstrated skills:

- University degree in Computer Science, Information Security, Information Technology, or a related discipline, or an equivalent combination of education, professional certifications, and practical experience.
- Professional certification in information security, governance, risk management, or audit, such as CISSP, CISM, CISA, CRISC, ISO 27001 Lead Implementer, or equivalent.
- Minimum eight years of progressive experience in information security, including significant experience in governance, risk management, compliance, security assessments, audit support, third-party risk managemen

📌 Senior Information Security, GRC Analyst (Toronto)
🏢 Cassels Brock & Blackwell
📍 Toronto