About this opportunity
We are looking to add an experienced security and compliance professional to join us as our Information Security Lead for the Digital Health and Discovery Platform (DHDP). Reporting to the National Director, DHDP, this role is accountable for establishing and leading the platform's information security programs across a highly distributed national research network. The successful candidate will work closely with technology, legal, and partner organizations to ensure the DHDP maintains the highest standards of security and privacy protection while enabling innovative health research. The ideal candidate is someone who possesses deep expertise in establishing cyber- and information security programs for organizations in regulated sectors, has familiarity with Canadian health privacy regulations, and is comfortable operating as the primary security leader.
This is a full-time, temporary position until September 2027.
About the Terry Fox Research Institute and Digital Health & Discovery Platform
The Terry Fox Research Institute (TFRI), named for Canadian icon Terry Fox, is built on Terry's dream to end cancer through research. Established in 2007, TFRI is a registered charity and invests its funds in cutting-edge cancer research through highly collaborative, team-oriented programs and national research networks. Together with its many research and funding partners, TFRI empowers Canada’s brightest researchers to seek out new transformational and precision medicine discoveries to advance our understanding, diagnosis, and treatment of cancer with the goal of significantly improving outcomes for patients.
The Digital Health and Discovery Platform (DHDP), a research initiative led by the Terry Fox Research Institute (TFRI), is a federated data-sharing and AI software product development project for advancing disease research where critical health data is resident at multiple institutions across Canada. This project sits at the intersection of healthcare and artificial intelligence and is among the first of its kind globally.
Key responsibilities
Information Security Governance
- Serve as the primary information and cyber- security subject matter expert for DHDP.
- Lead and deliver the DHDP SOC 2 Type II certification program, from scoping and control implementation through external audit and certification.
- Develop and maintain the organization's security governance framework, policies, standards, and procedures.
- Provide security guidance to executive leadership, project teams, and partner organizations.
- Working with IT, legal and privacy teams, support the organization and its partners to ensure and demonstrate compliance with Canadian health privacy and data protection requirements across jurisdictions, including PHIPA, Law 25, FIPPA, and PIPEDA.
- Monitor cyber risks, security standards and best practices and recommend changes to controls, policies, and platform practices.
- Work collaboratively with hospitals, academic institutions, and industry partners to identify, address and document compliance and security requirements while supporting successful platform adoption.
- Work directly with clients, hospitals, academic institutions, and industry partners that use DHDP to understand their security, privacy, and compliance requirements and translate them into practical platform controls, technical safeguards, processes, and operational practices.
Security Architecture and Engineering
- Lead security architecture reviews across the DHDP technology ecosystem in conjunction with the DHDP engineering and product team.
- Review infrastructure-as-code implementations, IAM configurations, RBAC models, secrets management, and privileged access controls.
- Drive security practices across containerized workloads, CI/CD pipelines, cloud infrastructure, and application deployments.
- Work with the Data Scientist and legal to define and maintain the security baseline for partner edge-node deployments.
- Define monitoring and logging requirements across the organization and its partner organizations using the DHDP.
Risk Assessment and Incident Readiness
- Lead risk assessments and support internal and external audit activities.
- Establish incident response processes, escalation pathways, and security event management procedures.
- Develop vulnerability management standards, remediation workflows, and risk tracking processes.
- Coordinate third-party assessments, penetration testing, and security reviews.
- Drive access cleanup, control improvements, and risk reduction initiatives during vendor and platform transitions.
Qualifications
- Bachelor's degree in Cybersecurity, Computer Science, Information Systems, Engineering, or a related discipline required.
- Minimum 7-10 years of progressive experience in cybersecurity, information security, privacy or related disciplines in regulated sectors dealing with sensitive data (namely health privacy).
- Professional designations such as CISSP, CISM, CRISC, CISA, ISO 27001 Lead Implementer/Auditor, or equivalent.
- Demonstrated experience operating as the primary or sole security leader within a small or scaling organization.
- Demonstrated experience leading a SOC 2 Type II program from planning and control design through certification.
- Experience working in health technology, research platforms, healthcare systems, or similarly regulated environments is an asset.
- Deep knowledge of security standards required under regulated data environments, subject to Canadian privacy legislation, particularly within healthcare and research, including in Quebec.
- Excellent written and verbal communication skills with the ability to engage technical and non-technical audiences.
- Strong risk assessment, decision-making, and stakeholder management skills.
- Hands-on experience reviewing cloud infrastructure, infrastructure-as-code, IAM configurations, RBAC policies, and security architecture.
- Familiarity with OHDSI/OMOP, GA4GH standards, or related health research data ecosystems.
- Experience with federated or distributed data architectures where data residency remains at participating sites.
- Experience securing Microsoft Azure environments and cloud-native architectures.
Benefits of working with us
- Flexible schedule
- Paid vacation
- Paid sick days
- Hybrid and remote work options available
- Extended medical and dental coverage
- A work culture that values excellence, creativity, teamwork, learning, fairness, and integrity
- A passionate group of high-performing teammates across Canada
Salary: $110,000 - $130,000 per annum
How to Apply: If you are passionate about making a difference in cancer research and are ready to take on this challenging and important position, we invite you to submit your application. This position is open to candidates residing and authorized to work in Canada.
Please include a cover letter, resume, and any relevant supporting documents. Applications can be submitted through Indeed or emailed to hr@tfri.ca.
Application Deadline: job requisition will be open until filled.
As an equal opportunity employer, we recognize the importance of diversity and equity in our workforce and encourage all qualified applicants to apply, including but not limited to Indigenous persons, women, persons with disabilities, minorities, and other underrepresented communities. Should an accommodation be required at any time, please let us know. We appreciate all applications, but only candidates selected for an interview will be contacted.