OverviewKPMG Canada is seeking an experienced professional to fulfill the role of Business Information Security Officer (BISO), Tax. This role reports to the Firm's Chief Information Security Officer and operates within the Tax Business Unit, serving as the primary liaison between the central security function and the business.
This internal-facing role will strengthen security oversight and governance across Tax's large and complex application development environment, helping teams consistently apply secure software development lifecycle (SDLC) practices while preserving business agility.
KPMG Canada's Digital Security Group is responsible for governing and overseeing the Firm's data and information security program.
Serving as the primary liaison between Tax and the Digital Security Group, the BISO, Tax will provide practical, risk-based guidance; oversee adherence to security policies and controls; and partner with Tax, Technology, Risk and Privacy stakeholders to identify, document and remediate cybersecurity risks. The successful candidate will bring hands-on security leadership experience from a mature development or security organization, with a strong understanding of application development, DevSecOps and secure SDLC practices.
What you will do- Serve as the primary information security liaison between the Tax business and the Digital Security Group
- Provide security oversight and governance across Tax's application development ecosystem, promoting consistent adherence to Firm security policies, standards and control requirements.
- Translate security policies, procedures and standards into practical, risk-based controls that support secure delivery without compromising agility
- Champion security-by-design and secure SDLC practices throughout the application and project lifecycle, including requirements, design, development, testing, deployment and ongoing operations
- Partner with development and technology teams to embed DevSecOps practices, strengthen secure coding standards and improve the consistent application of security controls
- Assess cybersecurity risks associated with business applications, cloud services, software, tools and emerging technologies, and provide clear recommendations aligned with business needs and Firm requirements
- Collaborate with Tax, Technology, Risk, Privacy and Security stakeholders to support security assessments, document requirements, drive decisions and track remediation activities to completion
- Monitor compliance with security policies and standards; identify control gaps or non-compliance, initiate remediation and manage exceptions through formal risk acceptance processes with appropriate compensating controls
- Develop and maintain the Tax business unit risk register, ensuring identified risks, recommendations, ownership and remediation plans are accurately documented and tracked
- Maintain visibility into the Tax technology landscape, including an accurate inventory of business applications, tools and technology assets across on-premises and cloud environments
- Provide relevant security metrics and insights through governance forums and recommend initiatives to improve the business unit's security posture and operational effectiveness
Vulnerability management & incident response
- Oversee business unit vulnerability management, including risk-based prioritization and remediation tracking across applications, endpoints and cloud environments
- Partner with Technology and development teams to drive timely and sustainable remediation of identified vulnerabilities
- Coordinate the Tax business response to security incidents in accordance with KPMG incident management processes and represent the business unit in critical incident response activities, as required
What you bring to the role- A bachelor's or master's degree in Information Technology, Computer Science, Cybersecurity or a related field, or equivalent practical experience
- Significant experience as a hands-on cybersecurity practitioner and security leader within a mature application development, technology or security organization
- Strong knowledge of the software development lifecycle and demonstrated experience embedding secure SDLC, DevSecOps and secure coding practices into modern development environments
- Experience establishing or strengthening security governance, oversight and compliance across a large and complex application portfolio or development organization
- Strong understanding of cybersecurity controls, risk management practices and recognized security frameworks, such as ISO 27001, NIST CSF and NIST 800-53
- Broad knowledge of application security, security architecture, cloud security, API security, vulnerability management and software supply chain risk
- Experience assessing security risks across cloud and on-premises environments, including SaaS solutions and modern application platforms
- Demonstrated ability to translate technical risks and security requirements into practical guidance for development, technology and business stakeholders
- Proven ability to influence across functions, drive accountability and bring security and compliance matters to a clear and timely resolution
- Strong communication, stakeholder management, analytical and problem-solving skills
- One or more relevant professional certifications, such as CISSP, CISA, CRISC or CISM, would be considered an asset
KPMG Ontario Region Pay Range InformationThe expected base salary range for this position is $146,000 to $196,000 and may be eligible for bonus awards. The determination of an applicant's base salary within this range is based on the individual's location, skills & competencies, and unique qualifications. In addition, KPMG offers a comprehensive and competitive Total Rewards program.
Providing you with the support you need to be at your bestOur Values, The KPMG WayIntegrity, we do what is right |
Excellence, we never stop learning and improving |
Courage, we think and act boldly |
Together, we respect each other and draw strength from our differences |
For Better, we do what matters
