Information Security Manager
Grant Thornton LLP
Toronto, ON
06.2021 - Current
- Defined, tracked, and analyzed key performance indicators to measure operational efficiency, quality, and goal achievement.
- Conducted team performance assessments to evaluate collaboration, skill effectiveness, and productivity, driving continuous improvement.
- Own strategic security roadmap, investment planning, and annual operating budgets supporting firm-wide risk reduction initiatives.
- Built and scaled OSINT and Digital Forensics Lab, expanding investigative and threat-hunting capabilities across national engagements.
- Translated AI-driven threat intelligence into actionable risk metrics for executive and board-level reporting.
- Direct red-team and penetration testing programs, ensuring executive visibility into systemic risk and remediation progress.
- Embedded AppSec controls into CI/CD pipelines, accelerating secure releases and reducing high-risk findings in production.
- Increased remediation velocity by 40% through operating-model redesign and automation.
- Accelerated business approvals by embedding security engineering into digital-delivery pipelines.
- Produced board-level cyber risk dashboards linking threats to financial exposure and regulatory consequences.
- Ensured AI security practices aligned with financial services regulations (FFIEC, GLBA, PCI DSS, NYDFS Cybersecurity Regulation) and AI risk frameworks (NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS).
- Defined policies and guardrails for secure and compliant AI adoption across the organization.
- Maintained service-level excellence during organizational transitions through workforce stabilization and process maturity.
- Matured the firm’s risk governance using the Three Lines of Defense (3LOD) model, improving accountability and visibility across business functions.
- Built and led an OSINT and Digital Forensics Lab supporting cybercrime investigations, threat hunting, and incident response.
- Direct in-house penetration testing and red-team activities, proactively identifying and mitigating critical vulnerabilities.
- Managed security Event Management using SIEM platforms within a SOC, monitoring, correlating, and responding to threats while tracking security KPIs for performance optimization.
- Applied cybersecurity CSF frameworks to assess SOC operations, improve incident response effectiveness, and align team performance with organizational security objectives.
- Lead multi-team strategic security projects, overseeing scope, delivery, budget, and stakeholder engagement.
- Strengthen the vulnerability management program by establishing standardized scanning, prioritization, and remediation workflows.
- Led reliability standards compliance audits and investigations, including monitoring, whistleblower intake, evidence analysis, breach determinations, and mitigation plan oversight in accordance with regulatory and administrative law requirements.