Senior Manager, Information Security Risk & Governance

Senior Manager, Information Security Risk & Governance

The Senior Manager, Information Security Risk & Governance leads the Information Security Risk Management and Governance programs. Their main objective is to manage risk and oversee cyber projects, technology selection, transition projects as well as third parties.

• Manage the Risk & Governance program
• Understand and manage Information Security risks pertinent to the organization’s business goals and work with various departments to identify, measure, monitor, and report on risk based on information assets
• Develop, document, and communicate risk mitigation strategies to risk owners; document and monitor the implementation of security controls and adjust risk rating accordingly
• Develop, maintain and report on KRI’s, KPI’s and SLA’s related to Information Security program.
• Research, implement and operate risk and governance technology tools and processes to enhance the effectiveness of the practice
• Develop new Information Security policies; ensure all existing policies and related documents are up to date
• 4 direct reports (Security Analysts)
• Oversee related cyber projects, technology selection, transition projects and third-party vendors
• Review security metrics and create forecasts

• Post-secondary degree in Computer Science or equivalent combination of education and experience to satisfy the requirements of the position.
• Minimum 8 years of progressive responsibilities in developing and supporting Information Security risks management and governance programs with 3 years in a management role
• Excellent knowledge of security technologies which are commonly used in enterprises to protect information systems, including on premise, Cloud and Mobile.
• Experience with Information Security and Risk Management frameworks like ISO
  27001/2, ISO
  27005, NIST CSF, NIST 800-30, SSAE
  18 and PCI
• Understanding of legal and regulatory compliance standards and requirements like PCI-DSS, PIPEDA for SOC2 and ISO audit purposes
• Experience overseeing related cyber projects, technology selection, transition projects and third-party vendors
• Experience reviewing security metrics and creating long term forecasts
• Experience with security architecture and platforms
• Experience working with KPI and KRI dashboards that deliver real-time insight into enterprise risk posture and control effectiveness
• CISSP, CISA, CRISC and other security certifications are an asset

This is a hybrid permanent position located in downtown Toronto with an annual salary of $ – $ plus bonus and benefits.