Cybersecurity Metrics and Controls Specialist

Location: Montreal, QC
Work Arrangement: Hybrid
Salary: $120,000–$150,000 CAD

Position Overview

We are seeking an experienced Cybersecurity Metrics and Controls Specialist to join the Continuous Controls Monitoring (CCM) team as part of the Metric Design & Architecture team.

The successful candidate will be responsible for designing, defining, and implementing cybersecurity and technology control metrics that measure control effectiveness, completeness, and operational efficiency. This role will work closely with Technology, Cybersecurity, Policy, Data, Tooling, and Reporting teams to ensure controls are accurately measured and effectively reported.

Key Responsibilities

• Establish and document control and risk metric definitions for technology and cybersecurity controls.
• Engage with stakeholders to understand business and technology processes and identify appropriate measurement approaches.
• Analyze quantitative and qualitative data to develop accurate and meaningful cybersecurity metrics.
• Define Key Control Indicators (KCIs), KPIs, and other control metrics to measure control implementation and effectiveness.
• Partner with Technology Policy teams to ensure control measurement and metric requirements are incorporated into policy design and updates.
• Work with metric consumers to establish reporting frameworks that meet business and stakeholder requirements.
• Partner closely with CCM data acquisition and tooling teams to successfully implement cybersecurity and technology metrics.
• Identify control gaps, measurement challenges, and opportunities for improvement.
• Support the development and continuous improvement of cybersecurity control monitoring and reporting capabilities.
• Communicate findings, recommendations, and metrics to stakeholders at various organizational levels.
• Manage stakeholder expectations and deliver high-quality work within tight deadlines.

Required Qualifications

• 10+ years of experience in Information Security, Cybersecurity, Information Technology, or a related field.
• 5+ years of hands-on experience with technology or cybersecurity control implementation.
• Demonstrated experience defining cybersecurity metrics, KPIs, KCIs, or control effectiveness measures.
• Strong understanding of technology and cybersecurity controls.
• Experience with risk management, governance, compliance, controls monitoring, or cybersecurity assurance.
• Strong analytical and problem-solving skills with the ability to make decisions using quantitative and qualitative data.
• Strong business acumen and strategic thinking.
• Excellent stakeholder management and communication skills.
• Ability to work effectively with technical and non-technical stakeholders.
• Experience working with customers, clients, or internal business partners.
• Ability to manage multiple priorities and perform effectively in a high-pressure environment with tight deadlines.

Technical Knowledge

Strong knowledge of several of the following cybersecurity domains:

• Identity and Access Management (IAM) and Authentication
• Data Security
• Network Security
• System Security
• Application Security
• Public Cloud Security
• Security Logging and Monitoring
• Incident Response
• Technology Risk and Controls
• Cybersecurity Governance and Compliance
• Continuous Controls Monitoring

Preferred Qualifications

• Cybersecurity certification such as CISSP, CISM, CRISC, CISA, or equivalent.
• Experience working within a large enterprise technology or cybersecurity environment.
• Experience with cybersecurity dashboards, reporting frameworks, data analysis, or control monitoring tools.
• Experience partnering with data acquisition, technology tooling, and reporting teams.
• Experience translating complex cybersecurity requirements into measurable and actionable metrics.