Manager, Security & Compliance

Stelumar Advanced Manufacturing Inc. (SAMI or Stelumar) is a technology-driven company dedicated to revolutionizing homebuilding in Canada through advanced modular building solutions. Founded by Canadian entrepreneur Peter Gilgan, founder of Mattamy Homes, Stelumar combines automation, robotics, and AI to modernize construction and help address the housing shortage. With state-of-the-art manufacturing facilities in the Greater Toronto Area, Stelumar is focused on accelerating construction timelines, improving consistency and making housing more attainable. Stelumar produces precision-built walls, floors, and roofing systems, factory-built modular units, and interior cabinetry and millwork at industrial scale. Its development and construction arm, Stelumar Communities, delivers scalable modular housing from planning and design to construction and handover. The team supports low- and mid-rise residential, purpose-built rental, affordable and workforce housing, student housing, hospitality, healthcare-related housing, and institutional developments. Together, Stelumar is delivering housing people are proud of.

For more information, visit Stelumar.com.

What we offer

This is a hands-on role at a fast-growing Canadian start-up using robotics, automation, and AI to take on the housing crisis. As our Senior Security and Compliance Administrator, you'll own the security posture and compliance program protecting SAMI's Greater Toronto Area manufacturing and corporate sites, from identity, endpoint, and network security to audits and the IT/OT security boundary. You'll have real ownership from day one and work at the leading edge of where cybersecurity meets the factory floor. We're looking for someone rigorous and dependable, with sharp risk judgment and the confidence to act on it.

What you’ll do

• Design and build SAMI's security and compliance program across IT and OT environments, establishing the roadmap, governance, standards, and operating model for Cabinetry, Panel, Modular, and Stelumar Communities.
• Implement and continuously mature SAMI's security suite (Sentinel SIEM, Defender for IoT/Endpoint/O365), and lead incident response end-to-end, from triage in the ITSM platform through resolution.
• Manage security controls across SAMI's hybrid AD/Entra environment, including Conditional Access, MFA, privileged access, Purview, and Intune compliance policies.
• Build and lead an end-to-end vulnerability management program: define scanning, patch compliance standards, and remediation tracking across servers, endpoints, and network infrastructure.
• Administer and audit Fortinet network security controls and the IT/OT network security boundary for PLC environments.
• Oversee SAMI's data protection and backup verification program (Cohesity, SQL Server Always On AGs) and support Tier 2 DR/BCP delivery.
• Manage the day-to-day relationship and audit cycle with SAMI's external auditors, including PwC, coordinating evidence, walkthroughs, and control testing; lead internal audit readiness and track findings to close.
• Administer security aspects of SAMI's ERP (Odoo) and MES-connected systems, including access reviews and segregation of duties.
• Run security awareness training and phishing simulations, and support security review of new SaaS tools and vendors.
• Partner with IT leadership to define security guardrails and enable the secure deployment of AI and automation tools from pilot through production.
• Other duties as assigned.

What you bring

• College Diploma or University Degree in Information Systems, Computer Science, Cybersecurity, or a related discipline.
• 5+ years of hands-on IT security and compliance administration experience, including demonstrated success designing, building, and implementing programs, controls, and processes across multiple sites and technologies.
• Demonstrated proficiency with SIEM (e.g., Microsoft Sentinel) and endpoint detection and response tools (e.g., Microsoft Defender).
• Hands-on experience with Microsoft 365/Azure security and compliance tooling, including Conditional Access, Purview, and Intune compliance policies.
• Working knowledge of NIST CSF and IT general controls (ITGCs), with hands-on experience supporting external audits and evidence requests.
• Solid networking/firewall fundamentals, ideally with Fortinet, across corporate and OT environments.
• Strong documentation habits, organization, and discretion handling sensitive security and compliance matters.
• Clear communicator who can explain risk and controls to non-technical stakeholders, auditors, and plant teams.

Bonus Points

• Industry certification such as Security+, SC-200, SC-300, SC-401, or CISSP (or working toward one).
• Prior experience as the auditee contact for PwC or another Big Four/national audit firm, or audit-side experience (SOC 2, ISO 27001).
• Hands-on exposure to OT/PLC network security in a manufacturing or industrial setting.
• Experience with FreshService, SolarWinds, or comparable ITSM and monitoring platforms.

Compensation

The expected base salary range for this position is $85,000 - $130,000. Actual pay may vary depending on your job-related knowledge, competencies, and skills. We recognize that exceptional situations may fall outside this range, and we encourage all interested candidates to apply.

You are also eligible to participate in Stelumar’s annual bonus program which gives you the opportunity to increase your total compensation if business and individual goals are achieved.

We encourage applicants who meet most of the role requirements to hit that submit button and apply! It’s okay if you don’t have 100% of the requirements. If you’re the right candidate, we’ll help you learn and grow.

Stelumar is committed to providing accommodation for people with disabilities. If you require accommodation through any aspects of the selection process, please notify us on your application and we will work with you to meet your needs.

Stelumar may use artificial intelligence (AI) tools to support our hiring process, including to help screen or assess candidates along the way. These tools work behind the scenes, while people remain at the heart of every hiring decision.

Qualified applicants for this existing vacancy will be contacted directly by the Talent Acquisition team.