Business Information Security Officer, Audit & Assurance

KPMG Canada is seeking an experienced professional to fulfill the role of Business Information Security Officer (BISO), Audit & Assurance. This role reports to the Firm's Chief Information Security Officer and operates within the Audit Business Unit, serving as the primary liaison between the central security function and the business. This is an exciting opportunity to combine client-facing security advisory experience with technology risk and controls expertise, supporting Audit delivery and transformation, including the secure adoption of AI-enabled solutions. KPMG Canada's Digital Security Group is responsible for governing and overseeing the Firm's data and information security program. The BISO will collaborate with Audit, ITS, Risk, Privacy, and Technology teams to assess cybersecurity risks, respond to client security requirements, and apply practical security controls The individual will provide security recommendations that reflect business needs, compliance and regulatory requirements, document and track identified risks, and obtain necessary risk and security approvals. The ideal candidate brings experience in a large, complex, multi-jurisdictional organization and can explain technology, data flows, and security controls clearly to internal teams and clients. Strong knowledge of application lifecycle practices, security architecture, cloud platforms, Generative AI, API security, and application security standards such as OWASP, along with familiarity with frameworks such as ISO 42001, will support success in this role. What you will do 34 Serve as the primary information security liaison between Audit and the Digital Security Group, being the first point of contact for client security questions34 Develop a thorough understanding of Audit applications and their security controls, data processing, and data locations, and explain these clearly to internal teams and clients34 Support reviews of security-related client contract conditions in collaboration with the appropriate Risk, Privacy, Legal, and Technology stakeholders34 Lead security-facing coordination for major client assessments, bringing together the broader supporting team and building trusted client relationships on security matters34 Coordinate consistent, proactive client security communications, including responses to emerging security concerns and inquiries34 Translate Firm security policies, procedures, and standards into practical, risk-based controls for the Business Unit technology ecosystem34 Proactively unblock and manage security, risk, and compliance issues by bringing together Audit, ITS, Risk, Security stakeholders, driving decisions, tracking actions, and ensuring issues are worked through to a clear and timely end state34 Monitor compliance with KPMG security policies, standards, and control requirements; identify non-compliance, initiate remediation actions, and track exceptions through formal risk acceptance processes with appropriate compensating controls34 Act as the BU key point of contact to understand security risks related to evolving business requirements for technology and solutions, and apply security-by-design principles to provide proactive, business-focused, guidance aligned with Firm's security policies and standards34 In coordination with Platform Security team, assess and review business-requested software, tools, and AI capabilities (including SaaS and Generative AI solutions) for security, privacy, and compliance risks; lead intake, risk evaluation, and provide delegated approval or whitelisting where necessary34 Collaborate with Project, Technology, Business, and Risk teams to gather requirements and support the Security Assessment Review (SAR) process, led by Platform Security34 Develop and maintain a business unit Risk Register to track security risks34 Coordinate with stakeholders to ensure security requirements are documented and tracked throughout the project lifecycle Governance 34 Maintain a strong understanding of KPMG security policies (e.g., GISP, AUP, ATO), requirements, and guidance from the CISO, Risk Management Partner, and Office of the General Counsel34 Maintain and validate a comprehensive inventory of business applications, tools, and technology assets (on-premises and cloud), ensuring alignment with Firm security standards34 Coordinate implementation and onboarding of new security programs and capabilities as directed by the CISO34 Contribute to annual business planning processes and recommend initiatives to enhance security posture and operational efficiency34 Represent the business unit and provide key metrics in monthly security governance forums Vulnerability Management and Incident Response 34 Own BU-level vulnerability management, including identification, prioritization, and remediation tracking across applications, endpoints, and cloud environments (including CSPM)34 Partner with Technology teams to drive timely remediation of identified vulnerabilities34 Manage responses to security incidents following KPMG's incident management processes34 Represent the business unit in SEV1 incident response bridges Monitoring 34 Monitor adherence to KPMG security policies and standards34 Review compliance reports generated by security tools and address identified issues34 Perform regular reviews of installed applications to identify prohibited software and initiate remediation actions34 Maintain an accurate and up-to-date inventory of business applications (on-premises and cloud environments including Azure, AWS, and GCP)34 Monitor control effectiveness across all technology assets within the business unit What you bring to the role 34 Bachelor's or Master's degree in Information Technology, Computer Science, Cyber Security or a related field, or equivalent experience34 10+ years of experience in application, technology, or solution design, architecture, development, and implementation34 5+ years of experience in secure design/architecture and project risk assessments across modern cloud and on-premises environments, including SaaS solutions34 5+ years of experience as a security practitioner in a leadership role34 Experience in large, complex, multi-jurisdictional organizations, including technology environments with data and systems distributed across locations and jurisdictions34 Deep understanding of modern application development ecosystems, open systems, Generative AI, and emerging technologies34 Strong knowledge of information security standards and frameworks (e.g., CSA CCM, ISO 27001/27017/27018/42001, PCI DSS, NIST CSF, NIST 800-53) and data protection principles34 Experience evaluating modern AI tools and capabilities and applying practical security guardrails to emerging technology and transformation initiatives34 Proven experience in a consulting or advisory role, collaborating with Technology, Project, and Business stakeholders with strong communication and relationship-building skills to address client security questions, assessments, and contract requirements34 Holding any of the following certifications would be considered an asset but not required: CISSP, CISA, CRISC, CISM This position requires written and oral fluency in English. The successful candidate will be required to support or collaborate with English-speaking colleagues or stakeholders nationally in our English speaking provinces while at KPMG.