Interim Chief Information Security Officer Our client, a leading academic institution, is making a significant investment in information security through the creation of a new Chief Information Security Officer position reporting to the CIO. This is an exceptional opportunity for a seasoned security leader to provide both strategic advice and operational leadership while building and strengthening this critical function. Working across the institution, the CISO will define the strategy, governance, policies and capabilities required to deepen and broaden information security, protect data and effectively manage evolving cyber risks. This is a highly purposeful mandate for someone who has built or transformed a security function before and wants to make a lasting impact within an important Canadian institution. Oversee institution-wide security resources and advise on policy, legislation, regulation, and technology. Lead security policies and practices that protect data and ensure compliance. Manage regulatory compliance, including Ontario's Enhancing Digital Security and Trust Act (2024), required contacts, biennial assessments, incident reporting, and executive and Board updates. Assess AI-related threats, defenses, adoption risks, phishing, agentic attacks, and third-party data leakage. Embed security controls in AI governance with the future Office of AI and key stakeholders. Maintain cyber insurance eligibility and advise on coverage and risk transfer. Support cloud adoption through risk-based vendor assessments and shared-responsibility guidance. Risk Management and Compliances Assess security controls and advise executives on improvements. Identify security risks and monitor compliance with standards and policies. Lead third-party risk management, including HECVAT reviews,



SOC 2 Type II attestations, cloud assessments, and shared-responsibility guidance. Align records retention and data disposal with policy, legislation, privacy, and cybersecurity requirements. Implement technical standards, services, and tools that reduce cyber risk. Maintain continuity, succession, and cross-training plans for disrupted operations. Report cybersecurity risk, control effectiveness, and strategy to executives and the Board Audit & Risk Committee. Maintain metrics for maturity, insurance, third-party ratings, vulnerabilities, and training completion. Lead security awareness programs and set measurable training targets for staff, faculty, and students. Report training completion and remediation plans to executives and the Board. Support cybersecurity-related academic programs as needed. Represent the organization in multi-agency threat-sharing, incident planning, and tabletop exercises. Partner with Privacy, Legal, Communications, and academic leaders on security matters. Lead, coach, and develop IT security staff within a client-focused culture. Oversee service quality, efficiency, stakeholder engagement, and SLAs. Build recruitment and retention plans that strengthen business and technical capability. Expert knowledge of NIST, ISACA, CIS Controls, and applicable legislation, including Ontario's Enhancing Digital Security and Trust Act, FIPPA, PIPEDA, and PHIPA.



Strong understanding of AI-enabled threats, defensive tools, vendor capabilities, and institutional AI risk. Knowledge of nation-state threats and geopolitical risks affecting Canadian post-secondary institutions. Expertise in network, endpoint, cloud, identity, vulnerability, and incident response security. Proven ability to develop cybersecurity strategy, assess risk, prioritize threats, and implement mitigation plans. Experience leading teams, projects, budgets, workforce planning, and service delivery. Excellent communication skills, including executive and Board-level reports and policies. Proven vendor, contractor, and third-party negotiation skills. A master's degree in information security, or other related field plus equivalent training and experience. Information security management qualifications such as CISSP (Certified Information Systems Security Professional), or CISM (Certified Information Security Manager). Minimum 10 years' progressively responsible experience in computing and information security, network security issues, and security incident response or related information technology fields, preferably in a higher education or equivalent complex environment. Minimum 5 years of experience in senior leadership and people management. Experience developing and administering an IS program and IS policy and regulations in a complex setting. Expertise in cyber security, in strategic planning, change management, resource management and reporting In accordance with the Ontario Human Rights Code, Accessibility for Ontarians with Disabilities Act and our AODA policy, a request for accommodation will be accepted as part of the hiring process.

📌 Interim CISO (Toronto)
🏢 LHH Knightsbridge
📍 Toronto