CanDeal Group is a leading provider of electronic marketplaces, data services, and technology solutions serving the Canadian capital markets. Through its marketplaces and data businesses, CanDeal delivers trading, pricing, analytics, and infrastructure solutions that support dealers, institutional investors, market participants, and technology providers across the fixed income and derivatives ecosystem.

Owned by Canada's leading financial institutions and market infrastructure providers, CanDeal combines the innovation and agility of a fintech with the scale, credibility, and market reach of an established industry leader. As CanDeal continues to expand its technology, data, and product offerings, legal support is increasingly critical to enabling innovation while managing risk.

This is an exciting time to join a growing organization led by visionary leaders who are helping to shape their industry’s future.

About the Role

We’re looking for a driven security skilled who wants to make an impact. This role provides broad exposure across Information Security governance, risk and assurance, with the opportunity to influence decisions, challenge existing approaches and help shape how security is implemented across the organization.

You’ll lead key activities across security governance, policy, risk management, business impact assessment, third-party security risk and assurance. Success in this role requires someone who can work independently, bring together complex or fragmented information, engage stakeholders across Technology and the business, and turn security requirements into practical outcomes.

It’s a role for someone who wants to keep learning, take on increasingly complex challenges and grow their responsibilities and influence over time.





What You’ll Do

- Lead the Information Security policy framework, standards, control library and review cycle, ensuring alignment across related security governance frameworks.
- Maintain the Information Security Risk Management Framework and coordinate the security risk register, including risk assessment, treatment, acceptance, monitoring, evidence, escalation and closure.
- Lead and facilitate security risk assessments for technology initiatives, systems, vendors and material changes, providing effective challenge and documenting risk decisions and required treatments.
- Lead the enterprise Business Impact Assessment (BIA) governance process, including methodology, facilitation, challenge, exercises, findings, action tracking and consolidated reporting, while business owners remain accountable for business impacts and recovery requirements.
- Lead third-party cybersecurity risk oversight, including intake, tiering, assessments, security requirements, exceptions, monitoring and reporting, working with Security Operations and Assurance where deeper technical expertise is required.
- Coordinate Information Security support for regulatory reviews, audits, customer assessments and independent assurance activities.
- Track security findings and remediation commitments arising from risk assessments, audits and assurance activities,



including escalation where appropriate.
- Develop security risk and governance metrics, committee materials, decision records and executive-level reporting.
- Provide governance guidance, procedures, control interpretation and evidence standards to Technology, Security Operations and other control owners.
- Coordinate cybersecurity incident governance, exercises and consolidated lessons learned while Technology and operational teams retain responsibility for technical response and recovery.
- Support security awareness, phishing exercises and targeted security communications, including completion tracking, metrics and escalation.
- Monitor relevant cybersecurity regulatory, industry and control-framework developments and assess their impact on security governance requirements.
- Identify opportunities to strengthen and simplify security governance practices and constructively challenge existing approaches where improvements can be made.

What You Bring

- 5+ years of relevant experience in information security, cybersecurity governance, technology risk, or a related discipline.
- Demonstrated experience independently leading security, risk or governance initiatives and driving them from problem identification through recommendation, stakeholder alignment and implementation.
- Experience developing and maintaining information security policies, standards and control frameworks.
- Practical experience conducting information security or technology risk assessments, evaluating controls and managing risk-treatment activities.
- Experience with third-party cybersecurity risk assessments, evidence reviews, findings and remediation tracking.
- Working knowledge of b

📌 Senior Security Analyst (Toronto)
🏢 CanDeal
📍 Toronto