Senior Manager, Information Security Risk

Final date to receive applications: 10/11/2026 Address: 100 King Street West Job Family Group:
Audit, Risk & Compliance This role sits within the Technology and Operations risk area as part of Operational and Non-Financial Risk (ONFR). As BMO’s independent second line of defense (2

LoD), ONFR oversees and challenges how operational and non-financial risks are managed across the Bank. ONFR works with the first line of defense (1

LoD) and other risk and control functions, applying risk expertise, informed judgment, and data-driven insight to support sound decisions. It maintains independent oversight and effective challenge to promote alignment with the Bank’s risk appetite and help protect the organization.

Role Overview The Senior Manager, Cyber Risk Oversight and Governance provides independent oversight and effective challenge of cybersecurity and related technology risks. The role advises senior leaders on material exposures and complex matters, offering an objective perspective to support decisions consistent with BMO’s risk appetite. Working across Cybersecurity, Technology, business lines, and risk and control functions, the Senior Manager assesses the Bank’s cybersecurity risk profile and provides strategic input on material initiatives, emerging technologies, significant issues, and evolving threats.

The role leads risk-based oversight, translates complex technical matters into clear risk implications, and delivers practical recommendations to senior management and governance forums. The ideal candidate is an experienced risk or technology professional who combines cybersecurity or broader technical expertise with strong judgment, clear communication, and the ability to provide constructive challenge collaboratively.

• Serve as a senior risk advisor, providing independent oversight, credible challenge, and actionable advice regarding cybersecurity and related technology risks, controls, strategies, and risk management practices.
• Develop and communicate an independent view of the cybersecurity risk profile across assigned portfolios, including material initiatives, emerging risks, control weaknesses, risk concentrations, and areas of heightened exposure.
• Provide strategic risk input and recommendations to senior leaders on business decisions, technology transformation, emerging technologies, third-party dependencies, and new capabilities with significant cybersecurity implications.
• Evaluate the design and effectiveness of cybersecurity governance frameworks, policies, standards, methodologies, controls, and risk management practices, and recommend proportionate enhancements where appropriate.
• Lead risk-based oversight activities, including independent risk assessments, thematic reviews, capability assessments, governance activities, and targeted evaluations of material or emerging risks.
• Challenge significant cybersecurity issues, incidents, risk acceptances, control deficiencies, and remediation plans, and advise on appropriate escalation where the level of risk or management response is not aligned with established expectations.
• Monitor and analyze risk appetite measures, risk indicators, control performance, issues, incidents, external threats, industry developments, and regulatory expectations to identify adverse trends and changes in risk exposure.
• Translate complex cybersecurity and technical matters into concise, decision-useful reporting, analysis, and recommendations for senior management, governance committees, Board-level forums, auditors, regulators, and other stakeholders.
• Act as a subject-matter expert and primary risk partner for assigned cybersecurity areas, using technical credibility, sound judgment, and constructive challenge to influence risk…