Cybersecurity Advisor

Senior Cybersecurity Advisor

Cybersecurity · Quebec City or Montreal · Remote, in-office presence as needed

At Vooban, we design custom systems and AI solutions for large enterprises that can’t afford to get security wrong. Finance, aerospace and defence, manufacturing, retail, infrastructure. Every project brings its share of sensitive data and connections to the client’s systems.

We’re not looking for a compliance person who ticks boxes. We’re looking for someone who has already been assigned to software development projects. A backlog, a story, poker planning: you know them. You follow the project sprint after sprint, you identify the right risks at the right time, and you raise the flag before go-live. Not after the incident.

A concrete example. A client wants a system that connects to an airport’s data to forecast flight arrivals and plan aircraft de-icing. You immediately see that our solution could become a gateway into the airport’s network. You name the intrusion risk, you recommend a clear measure to the team, and you make sure it’s in place before the production release sprint. That’s the job.

What you’ll do every day

• Support project teams (dev, AI, infra) from pre-sales to delivery to build security in from the design stage;
• Assess the risks of each project (threats, vulnerabilities, impact, likelihood) and recommend the right treatment;
• Define mitigation measures with project managers, architects, developers and clients, then follow them through to closure;
• Keep risk registers up to date (owners, deadlines, residual risk, formal acceptance);
• Translate standards (ISO 27001, NIST CSF, OWASP) into concrete controls that teams can actually apply;
• Review the security requirements in client contracts and clarify who is responsible for what between Vooban and the client;
• Assess the risks specific to AI solutions (training data, information leakage, prompt injection, third-party providers);
• Explain risks to a dev as well as to management, in French as well as in English.

Here are the strengths we’re looking for

• For you, security is a partnership with the teams, not a control;
• You propose measures proportionate to the risk. Not a fortress to protect a contact form;
• You speak business. If management asks you why invest $100,000 in a measure, you answer in terms of impact, not acronyms;
• You take your files through to closure, even without line authority over the teams;
• You have the autonomy and judgment of a senior role, and you stay curious about emerging threats;
• You communicate proactively, even remotely.

The must-haves to join our team

• At least 5 years of experience in cybersecurity, a good part of it supporting software development projects;
• A varied background. You’ve worked on several types of projects, not just one small piece of the puzzle;
• A solid command of risk management (ISO 27005 or equivalent) and of the ISO 27001/27002, NIST CSF and OWASP Top 10 frameworks;
• A college or university diploma (DEC, certificate, bachelor’s degree) in computer science, information security or a related field, or equivalent experience. Here, field experience counts more than paper;
• You use AI in your daily work and can talk about it concretely;
• You are bilingual, both spoken and written;
• You live in Quebec and can travel to our Quebec City or Montreal offices as needed.

What would make a difference

• CISSP, CISM, CRISC, ISO 27001 Lead Implementer or Auditor, CCSK certifications;
• Knowledge of AI-specific frameworks (ISO/IEC 42001, NIST AI RMF, OWASP Top 10 for LLM);
• Experience with SOC 2, CMMC or ITSP.10.171;
• Knowledge of Law 25 and privacy impact assessments (PIAs);
• Experience in incident management, identity and access management or data loss prevention (DLP);
• Experience in consulting services or client mandates.