Director, Information Security

Location: St. Catharines

This job advertisement is to fill an existing vacancy in the Administrative Professional (Employee Group)

About the Role:

Reporting to the Associate Vice-President, Information Technology Services, the Director, Information Security provides enterprise leadership and strategic direction for the University’s information security program, spanning security governance, policy and standards, risk management, security architecture, identity and access governance, security awareness, incident response, and cyber resilience. The incumbent serves as the University’s senior authority on information security and technology risk, setting security strategies, governance frameworks, policies, standards, and roadmaps that protect Brock’s digital assets, systems, and information resources and support regulatory and compliance requirements.

The Information Security portfolio governs security for the University; it sets requirements, assesses risk, assures the effectiveness of controls, and directs the response to security incidents, while day-to-day security controls are operated by ITS delivery teams under those standards. The Director, Information Security partners closely with ITS leadership, the University’s privacy function, the research portfolio, and institutional stakeholders to strengthen Brock’s security posture while enabling teaching, learning, and research.

The Director, Information Security will:

Provide senior leadership, strategic direction, and oversight for the University’s information security, cybersecurity, and technology risk programs;

Establish and advance the University’s information security vision, governance framework, and strategic roadmap to support institutional priorities and strengthen organizational resilience;

Lead the development and governance of enterprise security policies, standards, procedures, and control frameworks to protect University information assets and services, ensuring alignment with institutional objectives, regulatory requirements, and industry frameworks;

Direct the evolution of enterprise security architecture, secure-by-design principles, and technology standards to support a modern and resilient security posture;

Establish performance measures and reporting mechanisms that enable effective oversight and decision-making;

Provide strategic oversight of identity and access management, including standards and requirements for authentication, authorization, privileged access, and identity lifecycle management;

Advise academic, administrative, and technology leaders on emerging threats, cybersecurity risks, privacy considerations, and security-related strategic initiatives;

Oversee security risk assessment activities across applications, infrastructure, cloud services, research environments, third-party solutions, and business processes;

Establish and govern vulnerability management, threat monitoring, penetration testing, and security assessment programs to proactively identify and address risks;

Ensure security requirements are embedded throughout technology planning, procurement, solution design, implementation, and operational support processes;

Provide leadership and command authority for enterprise cybersecurity incident response, leading institutional response to cybersecurity incidents, data breaches, ransomware events, malware outbreaks, phishing campaigns, and other security threats;

Ensure effective monitoring, detection, investigation, containment, recovery, and reporting of cybersecurity incidents across the institution;

Champion enterprise-wide security awareness, education, and training programs that strengthen cybersecurity knowledge and accountability across the University community;

Provide leadership, coaching and mentorship to a Program Manager, Information Security, and an Information Security Analyst;

Support the University's research security obligations in partnership with the Office of Research, enabling researchers by embedding security across research activities while preserving a flexible operating environment.

Key

Skills and Experience:

Degree in a related discipline or the equivalent combination of education and experience;

Leadership experience…