IT Risk & GRC Specialist

Job Title: Information Security Specialist – Remediation QA, Testing & AI Transformation

Location: Toronto (OR) Mississauga, ON

Work Model: Hybrid – currently 2 days onsite, increasing to 4 days

Contract Duration: (6 months)

Extension / Conversion: Possible

Role Overview: Seeking a senior Information Security / IT Risk Specialist to provide independent assurance, challenge and quality oversight of audit and regulatory remediation activities impacting the information security control environment.

The individual will assess remediation plans, validate evidence, test control effectiveness and ensure audit/regulatory readiness. A key responsibility is to lead the design and implementation of an AI-enabled assurance capability to automate and strengthen remediation QA and challenge reviews.

Key Responsibilities

• Lead independent, risk-based reviews of audit and regulatory remediation plans.
• Perform sample-based testing using Inspection, Observation and Reperformance (IOR) methodology.
• Validate control design, implementation, operating effectiveness and sustainability.
• Assess remediation plans for completeness, risk alignment, evidence sufficiency, milestones and closure readiness.
• Identify control gaps, root causes, weaknesses and remediation deficiencies.
• Challenge evidence and provide structured QA feedback using established rubrics and professional judgement.
• Partner with Technology teams and stakeholders across all Three Lines of Defense.
• Advise on IT risk governance, information security controls, audit standards and GRC frameworks.
• Lead the design and implementation of an AI-enabled bot/capability for reviewing remediation plans, milestones and supporting evidence.
• Translate QA frameworks, scoring criteria and regulatory expectations into AI prompts, logic and evaluation workflows.
• Ensure AI solutions meet enterprise security, privacy, data protection and model risk requirements.

Must-Have Requirements

1. 10+ years of IT Risk experience, particularly in Governance, Risk and Compliance (GRC) within regulated industries.
2. Strong written and verbal communication skills; excellent documentation and stakeholder management.
3. Hands-on experience in IT audit, risk, information security, technology controls or remediation assurance.
4. Strong knowledge of audit testing, evidence evaluation, issue remediation validation, root cause analysis and control effectiveness assessments.
5. Experience reviewing and validating audit/regulatory findings and remediation plans.
6. Demonstrated ability to lead or implement AI-enabled assurance transformation, including AI-driven QA and challenge capabilities.
7. Experience working with Internal Audit, regulators, second-line oversight and technology control owners, preferably in financial services.

Certifications & Technical Knowledge

• CISA, CRISC, CISM, CIA or equivalent certification/experience preferred.
• Knowledge of IT risk and control frameworks: NIST, COBIT and ITIL.
• Experience with ServiceNow, RSA Archer, JIRA, Confluence, SharePoint and MS Office/Excel.
• Understanding of Agile methodologies, including Scrum and Kanban.
• Strong knowledge of technology risk, information security and control governance.

Nice to Have

• CISSP certification or equivalent experience.
• Six Sigma.
• AI Security / AI Risk experience and tools.
• Experience developing AI/ML-enabled risk, assurance or compliance solutions.

Ideal Candidate Profile

• Senior-level IT Risk / GRC professional with strong audit and remediation assurance experience.
• Strong ability to independently challenge remediation plans and supporting evidence.