Alteo is looking for a Chief Information Security, Risk and Compliancefor a permanent position based in Montreal.

Your main role will be to support the maturation of the IT risk management and compliance system in order to address the organization''s key challenges: implementing a security management system in accordance with international standards; measuring, managing, and controlling operational risks; ensuring platform compliance with payment market requirements; implementing and testing platform and service resilience mechanisms; responding to customer requirements in terms of security, business continuity, compliance, and data protection; managing operational risks and ongoing controls; contributing to the organization''s cross-functional initiatives and activities.

Based on the group''s strategy, you will be required to strengthen the measures deployed, implement operational risk management, deploy the permanent control system, promote and oversee its implementation, ensure that the IT continuity plan remains operational, and implement data governance.

Responsibilities: > Setting up the organization and governance of the business for North America Establish an organizational and governance framework for the business linked to its management, with regular monitoring and reporting.

Develop lasting relationships with all stakeholders involved in the exercise of its mission.

Contribute, as needed, to studies and discussions on risk, security, compliance, and data governance.

Promote the added value of risk management, business continuity, compliance (including data protection), and ongoing control, and ensure smooth communication. > Information system security and resilience Implement information security governance and organization for North America.

Define and obtain management approval for information system security guidelines and objectives for all activities within its scope.

Define and implement the general information system security policy.

Implement procedures related to information system security.

Identify, analyze, and assess risks, threats, and consequences (risk mapping).

Study the system for controlling risks related to information system security, taking into account regulatory and legal requirements, as well as customer requirements.

Define and deploy plans for dealing with information system security risks.

Raise awareness and provide training on data security and protection issues: promote the IT security charter to all users.

Manage IT security incidents: activate crisis units in the event of a disaster and ensure the necessary coordination with the departments involved.

Ensure that audits and intrusion tests are carried out in accordance with the strategy, management needs, and regulatory and contractual requirements.

Lead initiatives to strengthen the security culture within the Canadian business and ensure that all stakeholders are involved in risk management, so that everyone fully embraces their role, the cost-benefit/risk ratio is favorable, and the accepted level of residual risk is aligned with the risk appetite defined by management.

Define and oversee the IT security management system (standards, tools, incident tracking, audits, etc.).

Monitor regulatory and technical developments to ensure that the information systems security policy is in line with these developments.

Support the pre-sales team in due diligence exercises conducted by customers in the North American region.

Contribute to related projects and ensure compliance with contractual requirements.

Establish the framework and ensure the resilience of the provisions put in place for clients.

Ensure that annual tests are carried out, in coordination with clients and teams.

Ensure that existing certifications are maintained and that areas not covered (ISO 27001) are certified.

Ensure the production of SOC2 Type II reports at the required frequency. > Permanent control Define, based on the guidelines of the governing bodies, the organization and governance of the permanent control system.

Assist managers/service managers in the deployment of the operational risk management and permanent control system at level 1, within their scope of responsibility.

Ensure follow-up.

Using a holistic approach, ensure that operational risks are identified and qualified (e.g., self-assessment of risks and controls) and that the operational risk management system is deployed (e.g., management of outsourced services, implementation and monitoring of key risk indicators). > Compliance and personal data protection Ensure legal, regulatory, and contractual compliance with regard to information system security and personal data protection at the regional level: Recommend a compliance framework: identify non-compliance risks and ensure that appropriate prevention measures are implemented in accordance with the group''s key compliance principles and legal, regulatory, and contractual provisions.

Ensure the compliance of contracts (customers, suppliers, employees) and contractual clauses to meet security,



confidentiality, and personal data protection requirements.

Develop and implement all compliance-related instructions and procedures.

Ensure transparency and accountability in risk and compliance-related decision-making (reports and record-keeping, etc.).

Ensure compliance with applicable legal and regulatory obligations by drawing on the expertise of cross-functional group functions in this area.

Raise awareness and encourage employees to report violations of the code of conduct or compliance issues (through reporting channels and investigations, etc.). > Team management Build and supervise the team of controllers under your hierarchical responsibility.

Ensure the development, expertise, and skills advancement of employees in the respective risks to be covered.

Ensure the setting of annual objectives and employee evaluations.

Profile: Bachelor''s/Master''s Degree in IT or equivalent 10+ years of experience in information systems auditing/control.

Proficiency in the banking and financial regulatory setting (business knowledge, operational risks, controls).

Experience in the electronic banking industry (an asset). ISO27001, ITIL, COBIT, CEH, CISSP, CISA, CRISC, PMP certification (an asset).

Experience as a team manager.

Solid knowledge of IT, IT architecture, and related tools.

Solid knowledge of IT risk management, norms and standards, and cybersecurity.

Solid knowledge of process modeling and internal control frameworks (e.g., IIA, ISACA, etc.).

Proficiency in communication and facilitation tools and project management.

Excellent ability to analyze situations and operations, ability to synthesize information.

Managerial skills, good interpersonal skills, and ability to work with multicultural teams.

Proactive, ability to persuade.

Listening and negotiation skills, communication and diplomacy.

Leadership, initiative.

Rigorous, pragmatic, and methodical. @@@@@ Alteo est la recherche d''un Directeur Scurit, Risque et Conformit pour un poste permanent bas Montral.

Votre rle principal sera d''accompagner la monte en maturit du dispositif de lactivit autour de la gestion des risques TI et conformit afin de rpondre aux principaux enjeux de l''organisation: la mise en uvre dun systme de management de la scurit selon les standards internationaux; la mesure, la gestion et le pilotage des risques oprationnels; la mise en conformit des plateformes au niveau des exigences des marchs du paiement; la mise en place des mcanismes de rsilience des plateformes et services et leur test; la rponse aux exigences clients sur les volets de la scurit, la continuit dactivit, la conformit et protection des donnes; la gestion des risques oprationnels et contrle permanents; contribuer aux initiatives et activits transversales de l''organisation.

Sur la base de la stratgie du groupe, vous devrez renforcer les dispositifs dploys, mettre en uvre le management du risque oprationnel, dployer le dispositif de contrle permanent, le promouvoir et piloter sa mise en uvre, assurer le maintien en condition oprationnelle du plan de continuit informatique et mettre en uvre la gouvernance autour de la donne.

Responsabilits: > Mise en place de lorganisation et de la gouvernance de lactivit pour l''Amrique du Nord Mettre en place un cadre dorganisation et de gouvernance de lactivit li sa direction, avec des instances rgulires de suivi et de reporting.

Dvelopper des relations durables avec lensemble des interlocuteurs intervenant dans le cadre de lexercice de sa mission.

Contribuer, selon les besoins, aux tudes et rflexions en matire de risque, de scurit, de conformit et de gouvernance des donnes.

Promouvoir la valeur ajoute de lactivit de gestion des risques, de la continuit dactivit, de la conformit (protection de donnes inclus) et du contrle permanent, et assurer une communication fluide. > Scurit et rsilience des systmes dinformation Dcliner la gouvernance et lorganisation de la scurit de linformation pour l''Amrique du Nord.

Dfinir et faire valider par le management les orientations et les objectifs de scurit des systmes dinformation pour lensemble des activits de son primtre.

Dfinir et mettre en uvre la politique gnrale de scurit des systmes dinformation.

Mettre en place les procdures lies la scurit des systmes dinformation.

Identifier, analyser et valuer les risques, les menaces et les consquences (cartographie des risques).

Etudier le dispositif de maitrise des risques lies la scurit des systmes d''information, en considration les exigences rglementaires et lgales, ainsi que les exigences des clients.





Dfinir et dployer les plans de traitement des risques de scurit des systmes d''information.

Sensibiliser et former aux enjeux de la scurit et de la protection des donnes : assure la promotion de la charte de scurit informatique auprs de tous les utilisateurs.

Grer les incidents de scurit informatique : dclencher les cellules de crise en cas de sinistre, et assurer la coordination ncessaire auprs des services impliqus.

Sassurer de lexercice des missions daudit et de tests dintrusion, suivant la stratgie, les besoins du management, et les exigences rglementaires et contractuelles.

Mener les actions de renforcement de la culture scurit au sein de lactivit au Canada, et sassurer de limplication de tous les acteurs dans la gestion des risques, afin que chacun sapproprie pleinement son rle, que le cot bnfice/risques soit avantageux, et que le niveau de risque rsiduel accept soit align avec lapptence aux risques dfinis par le management.

Dfinir et piloter le systme de management de scurit informatique (norme, outils, suivi des incidents, audits).

Suivi des volutions rglementaires et techniques afin de garantir ladquation de la politique de scurit des systmes dinformation avec ces volutions.

Accompagner lquipe davant-vente dans les exercices de Due Diligence conduit par les clients de la rgion Amrique du nord.

Contribuer dans les projets y affrents, et assurer le respect des exigences contractuelles.

Mettre en place le cadre et sassurer de la rsilience des dispositions mis en place pour les clients.

Assurer la ralisation des tests annuels, en coordination avec les clients et les quipes.

Assurer le maintien des certifications existantes, et la certification des primtres non couverts (ISO 27001).

Assurer la production des rapports SOC2 Type II la frquence exige. > Contrle permanent Dfinir, partir des orientations des organes dirigeant, lorganisation et la gouvernance du dispositif de contrle permanent.

Assister les managers/responsables services dans le dploiement du dispositif de gestion des risques oprationnels et de contrle permanent de niveau 1, sur son primtre de responsabilit.

En assurer le suivi.

Avec une approche holistique, sassurer que les risques oprationnels sont identifis et qualifis (ex : auto-valuation des risques et des contrles), que le dispositif de maitrise des risques oprationnels est dploy (ex : pilotage des prestations de services externaliss, mise en place et suivi des indicateurs cls de risques). > Conformit et protection des donnes caractre personnel Assurer la conformit lgale, rglementaire et contractuelle sur les volets scurit des systmes d''information et protection des donnes caractre personnel au niveau de la rgion: Recommander un cadre de conformit : recenser les risques de non-conformit et sassurer de la mise en uvre des dispositifs de prvention appropris au regard des grands principes de conformit du groupe et des dispositions lgales, rglementaires et contractuelles.

Sassurer de la conformit des contrats (clients, fournisseurs, collaborateurs) ainsi que des clauses contractuelles pour rpondre aux exigences de scurit, de confidentialit, et celles lies la protection des donnes caractre personnel.

Dcliner et dployer toutes les instructions et procdures relatives la conformit.

Assurer la transparence et la responsabilisation dans la prise de dcisions lies aux risques et la conformit (rapports et tenue de dossiers).

Veiller au respect des obligations lgales et rglementaire applicables en sappuyant sur lexpertise des fonctions transverse groupe en la matire.

Sensibiliser et inciter les collaborateurs signaler les infractions au code de conduite ou aux problmes de conformit ( travers des canaux de dnonciation et enqutes) > Gestion d''quipe Constituer, puis superviser lquipe de contrleurs place sous sa responsabilit hirarchique.

Assurer le dveloppement, lexpertise et la monte en comptences des collaborateurs sur les risques respectifs couvrir.

Assurer la fixation des objectifs annuels et les valuations des collaborateurs.

Profil: Bac/Matrise en TI ou l''quivalent. 10+ annes d''exprience en audit/contrle en systmes dinformation.

Matrise de lenvironnement rglementaire bancaire et financier (connaissance mtiers, risques oprationnels, contrles).

Exprience dans l''industrie de la montique (un atout).

Certification ISO27001, ITIL, COBIT, CEH, CISSP, CISA, CRISC, PMP (un atout).

Exprience comme gestionnaire d''quipe.

Solides connaissances en TI, architecture TI et outils associs.

Solides connaissances en gestion des risques TI, normes et standards, cyber-scurit.

Solides connaissances en modlisation des processus, des cadres de rfrence de contrle interne (ex : de IIA, ISACA...) Matrise des outils de communication et danimation et de la gestion de projets.

Excellente capacit danalyse des situations et des oprations, esprit de synthse.

Qualits managriales, bon relationnel et aptitudes travailler avec des quipes multiculturelles.

Etre force de proposition, capacit convaincre.

Ecoute et ngociation, communication et diplomatie.

Leadership, esprit dinitiative.

Rigoureux, pragmatique et mthodique.

📌 Chief Information Security, Risk and Compliance [#4940] (Montreal)
🏢 Alteo
📍 Montreal