Chief Information Security Officer

OVERVIEW

The TTC recognizes the critical importance of cybersecurity and risk mitigation in protecting sensitive data, ensuring service continuity, preventing operational disruptions and maintaining public trust. In support of our Corporate Plan and to uphold our responsibility in providing secure and reliable services, the TTC is currently seeking a Chief Information Security Officer.

The Chief Information Security Officer (CISO) will serve as a visionary leader with the mandate to further transform our cybersecurity program, enhancing cybersecurity infrastructure, adopting advanced technologies, and continuously improving our risk management practices to stay ahead of emerging threats to ensure the highest level of protection.

Reporting directly to the Chief Information Officer (CIO), the CISO will be a pivotal member of the TTC Senior Management team, providing leadership and direction for Cybersecurity strategy and risk management.

POSITION SUMMARY

The CISO will be responsible for developing and implementing the TTC's cybersecurity strategy and budget, addressing cybersecurity from a strategic perspective, translating technical risks into business risks for both technical and non-technical stakeholders.

They will lead the creation and implementation of a cybersecurity management framework and multi-year roadmap, articulating a clear vision, mission, and deliverables. The CISO will foster robust communication and collaboration with cybersecurity leadership at the City of Toronto and ensure compliance with municipal, provincial, and federal standards and regulations. Additionally, they will establish and maintain strong relationships with executive leadership at the City of Toronto and various business stakeholders across the TTC to develop a unified cybersecurity framework, strategy, and operating model that addresses risk at all levels of TTC's technology, personnel, and business processes.

SCOPE & RESPONSIBILITIES

The duties of this role will include but are not limited to the below:

• Lead the cybersecurity function across TTC to ensure consistent and high-quality cybersecurity management in support of TTC's corporate plan, organizational policies, and directives.
• Develop and oversee a comprehensive cybersecurity vision, strategy, framework, and multi-year program plan aligned with TTC's priorities and business objectives. Ensure team engagement and senior stakeholder buy-in while providing tailored cybersecurity expertise and services to management and staff, detailing strategic goals, industry compliance, reporting mechanisms, budgets, and continuous improvement initiatives.
• Manage the department budget, preparing financial reporting, operational plans and performance objectives for cybersecurity programs, technologies, and activities.
• Guide enterprise technology leadership and Executives to prioritize security initiatives and spending based on relevant business risk, legislation and regulatory compliance, financial implications, and alignment with the corporate strategic plan.
• Lead the identification, development, implementation and maintenance of technologies, processes, procedures, standards, and protocols across the TTC to protect the privacy, confidentiality, integrity and systems to reduce security risks and increase resiliency.
• Monitor and evaluate program performance and health through quantitative or qualitative key performance indicators (KPIs) metrics and key risk indicators (KRIs) to gauge service effectiveness and efficiency. Participate in cybersecurity audits and assessments of the IT and OT environments.
• Facilitate a cybersecurity governance structure through the implementation of a governance program, including the formation of a cybersecurity steering committee or advisory board.
• Further enhance the cybersecurity incident response plan and ensure TTC is prepared to detect, respond, and recover from a cybersecurity incident.

• Establish vendor relationships and develop outsourcing plans to meet potential demands where in-house skill-sets, resources, and technology are limited.
• Prepare and present security and risk management reports to executive leadership and the Board.
• Engage Municipal and/or Provincial stakeholders to exchange information and to provide input into joint issues as required.
• Respond to and/or coordinate responses to inquiries or information requests made by TTC Commissioners, City Councilors and staff or other external parties as required.
• Monitor the flow of work to ensure cybersecurity program activities meet quality and quantity standards and address cybersecurity risks at an enterprise level.
• Promote a respectful work and service environment that supports diversity, inclusion, and is free from harassment and discrimination in accordance with the OHRC and AODA.
• Perform all other related duties as assigned.

KEY SKILLS & EXPERTISE

• Demonstrated experience and success in senior leadership roles in cybersecurity, IT, risk management, and/or operations technology security.
• Hands-on cybersecurity experience directly leading teams through the establishment of security programs including architecture and design, policies, procedures, standards, controls, frameworks and metrics.
• Extensive experience working in complex technical and organizational environments with a deep understanding of cybersecurity concepts, networks, applications, threat landscape, risk management, and technical knowledge of Operational Technology, Data Center and cloud technologies.
• Working knowledge of legal requirements and common information security management frameworks - ISO 27001, ITIL, COBIT and NIST including 800-53.
• Experience with contract/vendor management and negotiations.
• Direct experience in designing and implementing an enterprise-wide multi-year cybersecurity roadmap; identifying scope, financial/budgetary requirements, prioritizing risks, scheduling and required resources.
• Expertise developing reporting tools that deliver precise information on KPIs and KRIs.

• Proven ability to assess, manage, monitor, and report cybersecurity risks (vulnerability management, penetration testing), as well as incident response and forensics.
• Extensive experience in communicating security requirements and risks to non-technical staff, management, and key stakeholders.
• Excellent interpersonal and communication skills to liaise with all levels, able to quickly establish rapport with various teams and departments.
• Strong ability to manage and lead change, motivating teams and influence stakeholders.
• Expert people leadership skills with ability to manage reporting managers and staff; to direct, coach, develop and manage performance of reporting senior leaders; to lead multi-functional teams that contribute to succession planning.
• Understand the evolving nature of cybersecurity, able to pivot strategies based on new trends, technologies, and threats.
• Industrial technology cybersecurity experience (SCADA, ICS) and/or transit cybersecurity experience would be an asset.
• Must have or rapidly acquire a comprehensive knowledge of the Ontario Human Rights Code and Related Orders including disability accommodation and accessibility requirements pertaining to passengers and employees.

EDUCATION & PROFESSIONAL CREDENTIALS

• Post-secondary degree in computer science, cybersecurity, information technology, IT management, business administration or a related field or equivalent combination of education and experience. MBA would be an asset.
• Certified Information Systems Security Professional (CISSP) certification would be an asset.
• Certified Information Security Manager (CISM) certification would be an asset.
• Any additional cybersecurity, risk or audit certification(s) would be an asset.

CORE COMPENTENCIES

• Strategic Mindset & Decisive, Visionary Thinker
• Hands-On Leadership Approach & Interpersonal Effectiveness
• Adaptability & Change Management
• Process-Driven & Results-Oriented