Business Information Security Officer, Tax

At KPMG in Canada, our people bring their unique perspectives to Canada’s most important challenges. Here, you can build momentum that reaches beyond our business, develop skills for the future, and take ownership of your career with support at every stage. Join a firm where your career can make a difference.

KPMG Canada is seeking an experienced professional to fulfill the role of Business Information Security Officer (BISO), Tax. This role reports to the Firm’s Chief Information Security Officer and operates within the Tax Business Unit, serving as the primary liaison between the central security function and the business.

This internal-facing role will strengthen security oversight and governance across Tax’s large and complex application development environment, helping teams consistently apply secure software development lifecycle (SDLC) practices while preserving business agility.

KPMG Canada’s Digital Security Group is responsible for governing and overseeing the Firm’s data and information security program.

Serving as the primary liaison between Tax and the Digital Security Group, the BISO, Tax will provide practical, risk-based guidance; oversee adherence to security policies and controls; and partner with Tax, Technology, Risk and Privacy stakeholders to identify, document and remediate cybersecurity risks. The successful candidate will bring hands-on security leadership experience from a mature development or security organization, with a strong understanding of application development, DevSecOps and secure SDLC practices.

• Serve as the primary information security liaison between the Tax business and the Digital Security Group
• Provide security oversight and governance across Tax’s application development ecosystem, promoting consistent adherence to Firm security policies, standards and control requirements.
• Translate security policies, procedures and standards into practical, risk-based controls that support secure delivery without compromising agility
• Champion security-by-design and secure SDLC practices throughout the application and project lifecycle, including requirements, design, development, testing, deployment and ongoing operations
• Partner with development and technology teams to embed DevSecOps practices, strengthen secure coding standards and improve the consistent application of security controls
• Assess cybersecurity risks associated with business applications, cloud services, software, tools and emerging technologies, and provide clear recommendations aligned with business needs and Firm requirements
• Collaborate with Tax, Technology, Risk, Privacy and Security stakeholders to support security assessments, document requirements, drive decisions and track remediation activities to completion
• Monitor compliance with security policies and standards; identify control gaps or non-compliance, initiate remediation and manage exceptions through formal risk acceptance processes with appropriate compensating controls
• Develop and maintain the Tax business unit risk register, ensuring identified risks, recommendations, ownership and remediation plans are accurately documented and tracked
• Maintain visibility into the Tax technology landscape, including an accurate inventory of business applications, tools and technology assets across on-premises and cloud environments
• Provide relevant security metrics and insights through governance forums and recommend initiatives to improve the business unit’s security posture and operational effectiveness

Vulnerability management & incident response

• Oversee business unit vulnerability management, including risk-based prioritization and remediation tracking across applications, endpoints and cloud environments
• Partner with Technology and development teams to drive timely and sustainable remediation of identified vulnerabilities
• Coordinate the Tax business response to security incidents in accordance with KPMG incident management processes and represent the business unit in critical incident response activities, as required

• A bachelor’s or master’s degree in Information Technology, Computer Science, Cybersecurity or a related field, or equivalent practical experience
• Significant experience as a hands-on cybersecurity practitioner and security leader within a mature application development, technology or security organization
• Strong knowledge of the software development lifecycle and demonstrated experience embedding secure SDLC, DevSecOps and secure coding practices into modern development environments
• Experience establishing or strengthening security governance, oversight and compliance across a large and complex application portfolio or development organization
• Strong understanding of cybersecurity controls, risk management practices and recognized security frameworks, such as ISO 27001, NIST CSF and NIST 800-53
• Broad knowledge of application security, security architecture, cloud security, API security, vulnerability management and software supply chain risk
• Experience assessing security risks across cloud and on-premises environments, including SaaS solutions and modern application platforms
• Demonstrated ability to translate technical risks and security requirements into practical guidance for development, technology and business stakeholders
• Proven ability to influence across functions, drive accountability and bring security and compliance matters to a clear and timely resolution
• Strong communication, stakeholder management, analytical and problem-solving skills
• One or more relevant professional certifications, such as CISSP, CISA, CRISC or CISM, would be considered an asset

KPMG Ontario Region Pay Range Information

The expected base salary range for this position is $146,000 to $196,000 and may be eligible for bonus awards. The determination of an applicant’s base salary within this range is based on the individual’s location, skills & competencies, and unique qualifications. In addition, KPMG offers a comprehensive and competitive Total Rewards program.

Providing you with the support you need to be at your best

Integrity, we do what is right | Excellence, we never stop learning and improving | Courage, we think and act boldly | Together, we respect each other and draw strength from our differences | For Better, we do what matters

KPMG in Canada is a proud equal opportunities employer and we are committed to creating a respectful, inclusive and barrier-free workplace that allows all of our people to reach their full potential. A diverse workforce is key to our success and we believe in bringing your whole self to work. We welcome all qualified candidates to apply and hope you will choose KPMG in Canada as your employer of choice.

Adjustments and accommodations throughout the recruitment process

At KPMG, we are committed to fostering an inclusive recruitment process where all candidates can be themselves and excel. We aim to provide a positive experience and are prepared to offer adjustments or accommodations to help you perform at your best. Adjustments (informal requests), such as extra preparation time or the option for micro breaks during interviews, and accommodations (formal requests), such as accessible communication supports or technology aids, are tailored to individual needs and role requirements. You will have an opportunity to request an adjustment or accommodation at any point throughout the recruitment process. If you require support, please contact KPMG’s Employee Relations Service team by calling 1-888-466-4778.

AI Usage

We embrace the use of artificial intelligence (AI) to enhance the candidate experience and streamline our recruitment processes. AI tools may help with organizing applications or surfacing relevant qualifications. However, no hiring decisions are made using AI. Every hiring decision is made by our hiring managers and recruitment professionals, who are equipped with training that empowers them to use these tools responsibly. AI technologies used in our recruitment process undergo detailed risk assessments, including security and privacy requirements, that align with KPMG’s Trusted AI framework.

We believe technology should empower human judgment, not replace it. It’s one of the many ways we’re delivering on our vision of being a technology-first, people-driven firm.