This role is 4 days a week in the Toronto office

Reporting to the Director of Enterprise Architecture, the IT Security Manager is responsible for leading the implementation, operation, monitoring, compliance, and continuous improvement of the firm’s global cybersecurity program within the Canadian region.

The role serves as the primary liaison between Canadian business and technology teams and the Global Chief Information Security Officer (CISO) organization, ensuring security controls, policies, standards, and cybersecurity initiatives are effectively implemented, monitored, and enforced within Canada.

The IT Security Manager is accountable for maintaining visibility of regional cybersecurity risks, coordinating security remediation efforts, supporting regulatory and client security requirements, and providing cybersecurity assurance and reporting to Canadian leadership and Global Information Security stakeholders.

The role operates in close partnership with the Global CISO organization and is responsible for ensuring Canadian operations align with global cybersecurity governance, risk management frameworks, security architecture standards, and incident response processes.

Key Responsibilities

Implement and operationalize the firm’s global cybersecurity strategy within Canada.

Represent Canada in global cybersecurity governance forums, steering committees, and security working groups.

Coordinate implementation of global cybersecurity initiatives and control enhancements within the Canadian region.

Monitor regional compliance with global cybersecurity policies, standards, and control requirements.

Escalate Canadian cybersecurity risks, exceptions, regulatory concerns,



and material security issues through established governance processes.

Support regional adoption of global security technologies, standards, and best practices.

Information Security Governance & Compliance

Implement, communicate, monitor, and enforce compliance with global cybersecurity policies, standards, procedures, and control requirements within Canada.

Ensure Canadian business units understand and comply with global cybersecurity requirements.

Coordinate regional cybersecurity control assessments and compliance reviews.

Monitor and report regional compliance against enterprise cybersecurity control frameworks.

Support global policy reviews by identifying Canadian regulatory, operational, and client-specific requirements.

Coordinate remediation plans for identified control deficiencies and compliance gaps.

Security Operations & Incident Response

Coordinate Canadian cybersecurity operational activities in partnership with the Global Security Operations Center (SOC).

Act as the primary regional point of contact for cybersecurity incidents impacting Canadian operations.

Coordinate regional response activities during cybersecurity incidents and security investigations.

Support evidence collection, forensic investigations, remediation planning, and recovery efforts.

Facilitate communications between Canadian business stakeholders,



technology teams, legal counsel, privacy teams, and Global Information Security.

Monitor remediation activities resulting from cybersecurity incidents and security investigations.

Participate in regional and global incident response exercises and cyber resilience testing.

Support implementation of globally managed security technologies and controls.

Security Architecture & Technology Assurance

Ensure Canadian technology solutions, projects, applications, and infrastructure comply with global security architecture standards and approved design patterns.

Participate in technology and project review processes to validate alignment with cybersecurity requirements.

Identify regional regulatory, privacy, and business requirements that may require additional security controls.

Define supplementary Canadian security standards where local legal, regulatory, or client obligations require additional protections.

Collaborate with Global Security Architecture teams on security reviews, risk assessments, and control exceptions.

Canadian Regulatory & Privacy Compliance

Monitor Canadian legal, regulatory, privacy, qualified, and client cybersecurity obligations.

Work collaboratively with the Global Information Security organization to ensure these requirements are appropriately addressed within the firm’s control environment.

Support compliance initiatives related to:

PIPEDA

Quebec Law 25

Provincial privacy legislation

Client confidentiality requirements

Legal professional privilege obligations

Cross-border data transfer requirements

Data residency requirements

Support response

📌 IT Security Manager (Canada)
🏢 Norton Rose Fulbright
📍 Canada