Security Threat and Risk Assessment Lead (Contract)

ascio is hiring a Security Threat and Risk Assessment Lead to support our security and risk work across a range of systems, cloud services, procurements and existing technology environments.

This role will lead security threat and risk assessments from initial scoping through to final reporting, translating technical findings into clear risks, priorities and recommended actions for technical teams and decision makers.

Responsibilities

1. Define the scope, boundaries and depth of security threat and risk assessments.
2. Identify threats, model attack paths and assess existing security controls.
3. Assess likelihood, impact and residual risk using a consistent risk methodology.
4. Review system architectures, data flows, integrations and cloud configurations.
5. Develop practical risk treatment plans identifying priorities, actions, ownership and level of effort.
6. Prepare clear security assessment reports for technical and non-technical audiences.
7. Present findings and recommendations to executives, audit committees and governance bodies.

Required Skills and Experience

1. Eight or more years of experience in information security, including at least five years leading security threat and risk assessments.
2. Demonstrated experience applying a threat and risk assessment methodology from scoping through assessment, reporting and risk treatment.
3. Experience conducting threat modelling using STRIDE, attack trees, MITRE ATT&CK or comparable approaches.
4. Experience assessing security controls against frameworks and standards including ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIST CSF 2.0 or NIST SP 800-53.
5. Strong architecture and data-flow analysis skills across on-premises, Microsoft Azure, AWS and SaaS environments.
6. Cloud security assessment experience covering identity and access management, network segmentation, encryption, logging and monitoring.
7. Experience conducting third-party and vendor security assessments.
8. Strong written and verbal communication skills, with the ability to explain security risks clearly to both executive and technical audiences.

Qualifications

1. Degree or diploma in computer science, information systems or a related field, or equivalent professional experience.
2. One or more current professional certifications, such as CISSP, CRISC, CISM, CCSP, ISO/IEC 27001 Lead Auditor or ISO/IEC 27001 Lead Implementer.
3. Applicants must be able to provide certification status and expiry dates, where applicable.
4. Training or demonstrated experience with a recognized risk methodology such as ISO/IEC 27005, OCTAVE, FAIR or HTRA.

Preferred Experience

1. Privacy impact assessments.
2. Operational technology or industrial control system security assessments.
3. Experience working within large, multi-department organizations.
4. Application security and secure development lifecycle reviews.

Location and Work Arrangement

1. Remote within Canada.
2. Some assignments may require occasional onsite work or travel within Canada.
3. Applicants must be based in Canada and legally entitled to work in Canada.
4. A criminal record check may be required before access to sensitive systems, information or environments.