Cybersecurity Metrics & Controls Specialist — Controls Governance, KRIs/KPIs, Risk & Compliance Reporting (Hybrid, Montreal)Job Overview
We are seeking a Cybersecurity Metrics and Controls Specialist to join the Continuous Controls Monitoring (CCM) team, specifically within the Metric Design & Architecture team. This team quantifies and reports on the implementation correctness and operating efficiency of Technology controls.
The ideal candidate brings deep, hands-on expertise in cybersecurity controls frameworks and governance, controls design, implementation, and effectiveness testing, and security metrics, KPIs, KRIs, and reporting. This role is not a general security assessment/audit position — we are specifically looking for candidates with demonstrated depth in controls governance, controls testing, metrics design, and risk & compliance reporting.
Key Responsibilities
- Establish and document Control/Risk metric definitions for Technology controls by engaging with various stakeholders, understanding processes, and analyzing data for accurate measurement.
- Engage with the Technology Policy team to ensure Control Measurement/Metric requirements are met through the Policy design/update process.
- Partner with various Metric consumers to establish a Reporting framework that meets their requirements.
- Partner closely with the CCM Data acquisition and tooling team for successful implementation of metrics.
- Design, implement, and test the effectiveness of cybersecurity controls.
- Monitor controls and track remediation activities.
- Manage stakeholder relationships and deliver executive-level reporting.
Required Skills & ExperienceExperience
- 10+ years of experience in information security and/or information technology.
- 5+ years of hands-on experience with technology or cybersecurity control implementations.
- Proven experience in cybersecurity controls framework and governance.
- Hands-on experience in controls design, implementation, and effectiveness testing.
- Strong experience with security metrics, KPIs, KRIs, and reporting.
- Experience in risk management and regulatory compliance.
- Experience in control monitoring and remediation tracking.
- Experience in stakeholder management and executive-level reporting.
Technical & Domain Knowledge
- Ability to define metrics / Key Control Indicators to show control implementation completeness.
- Knowledge of various domains of Technology control / Cybersecurity.
- Knowledge of Public cloud technology.
- Knowledge of security concepts and tools around Identity & Authentication, Data Security, System Security, Network Security, and Application Security.
- Knowledge of security logging, monitoring, and incident response.
Soft Skills
- Strong business acumen and a strategic mindset.
- Experience working with and understanding the needs of customers or clients.
- Strong interpersonal skills, with the ability to interact at all levels and be effective as part of a broader team.
- Ability to manage expectations and handle high-pressure situations with tight deadlines.
- Proven analytical skills and decision-making ability based on quantitative and qualitative data.
Preferred
- Cybersecurity certifications.
Pay: $60.00-$65.00 per hour
Work Location: Hybrid remote in Montréal, QC