Who We AreAt Air Canada Vacations, we're in the business of making dreams travel. That's why we offer vacation packages, tours, cruises and more tailored to everyone's individual needs. We like to say we have a vacation for every traveller because we do!If you're someone who's passionate about exploring the world and sharing that enthusiasm with our customers, we'd love to welcome you to our team.For over 50 years, Air Canada Vacations has been making travel easy, so come and join us in helping fellow Canadians create unforgettable memories wherever they go.Job Title: Partner, Cybersecurity Governance, Risk and ComplianceDepartment: IT - OperationsLocation: YULReporting Manager: Director, IT Operations, Infrastructure and SecurityReporting to the Director, IT Operations, Infrastructure and Security.The Partner, Cybersecurity Governance, Risk & Compliance will be responsible for establishing and enforcing cybersecurity governance across strategic transformation initiatives (Juniper, CRM, CDP), while designing and implementing a structured cybersecurity framework for Air Canada Vacations aligned with industry standards (NIST or ISO 27002). This role will modernize cybersecurity policies, define and classify critical information assets, and ensure that cybersecurity is integrated into all projects and business processes from inception.What You'll Be DoingCybersecurity Governance for Strategic ProgramsEstablish security governance structures for Juniper (Reservation System), CRM, CDPImplement:Security checkpoints and stage gatesRisk and compliance reviews within project lifecycleEnsure alignment with:Privacy requirements (PIA, data retention, etc.)Architecture and Change Management processesEnforce "secure by design" governance across all initiativesCybersecurity Framework DevelopmentDesign and implement an enterprise cybersecurity framework for ACV based on NIST Cybersecurity Framework or ISO 27001 / 27002 controlsDefine:Control domains and control catalogSecurity standards and proceduresGovernance and accountability modelPolicy & Directive ModernizationReview,



rationalize, and modernize Cybersecurity policies, directives and proceduresAlign policies:With Air Canada corporate standards where applicableReflect up-to-date architectures (cloud, SaaS, APIs)Establish clear policy lifecycle and governance modelEnterprise Asset Management & Data ClassificationDefine and implement:Enterprise asset inventory (applications, systems, data)Data classification model (e.G., confidential, regulated, internal)Identify:Critical systems and business assetsSensitive and regulated data setsEnsure classification drives Access controls, Retention policies, and Security controlsRisk Management & ComplianceEstablish cybersecurity risk management framework:Risk identification and assessmentRisk tracking and remediationFormalize exception and risk acceptance processesAI Governance & Responsible UseDefine and implement AI governance framework including:AI usage policies and directivesRisk and compliance controls for AI systemsData usage and model governance standardsEstablish:Approval process for AI use casesMonitoring and audit mechanisms for AI solutionsEnsure alignment with Air Canada enterprise policies (where applicable)What You Bring To The Team8–12+ years in Cybersecurity governance / GRC and Risk management / ComplianceCertifications required (CISSP and / or CISM)CRISC, an assetISO 27001 Lead Implementer or Lead Auditor, an assetNIST Cybersecurity Framework Training Certification, an assetCDMP,



an assetProven experience:Implementing NIST or ISO frameworksSupporting large transformation programsEstablishing governance modelsExposure to AI/data governance initiativesGood understanding of:Data governance and classificationAI governance concepts (risk, ethics, controls)Cloud and SaaS environmentsExtremely organized and diligent in maintaining consistencyAutonomous and dedicatedExcellent communicatorResults oriented and the ability to manage multiple priorities with a sense of urgency and orientation to deadlinesWHY WORK WITH US?Our team loves to travel, and we have one of the most generous employee travel programs in the industry. You'll be eligible for travel privileges for yourself and other eligible persons once you've completed 6 months of serviceHybrid work model: Corporate Mandate of 4 days in office (Tuesday, Wednesday, Thursday + 4th day of your choice) and 1 day from homeWe value your wellbeing and offer a wide variety of benefit plans, including health and dental, for you and your familyWe offer training and development tools to help unlock your full potentialPlease note that these benefits apply to permanent, full-time employees.OUR COMMITMENT TO DIVERSITY, EQUITY, AND INCLUSIONAir Canada Vacations is committed to ensuring a Diverse, Equitable, and Inclusive Workplace, fundamental to its core values. We celebrate the uniqueness of every individual, listen to every voice, and instill a sense of belonging in our people that allows each team member's authentic self to truly shine.We encourage individuals of all backgrounds to apply as we strive to create a diverse team that mirrors the diversity of the customers and communities we serve as an equal opportunity employer. Should you require any accommodation, please inform us and we will work with you to meet your accessibility needs. For any accessibility-related assistance, requests for information in accessible alternative formats or to report any accessibility problems, please share in your application.Linguistic RequirementsWhen qualifications are equal, preference will be given to bilingual candidates. The position involves daily interactions with partners, clients, and colleagues located outside of Quebec.

📌 Partner, Cybersecurity Governance, Risk And Compliance (Montreal)
🏢 Air Canada Vacations
📍 Montreal