WHAT YOU’LL BE RESPONSIBLE FOR: Policy & Standards

Develop, review, and maintain security policies, standards, and procedures aligned with industry frameworks (NIST, ISO 27001, CIS, SOC 2, etc.)

Ensure policies stay current with regulatory, contractual, and business requirements

Assess security controls, gaps, and risk for new technologies, projects, and initiatives

Evaluate third-party/vendor security controls and manage vendor risk assessments

Conduct enterprise and project-level risk assessments

Serve as a security advisor to business and engineering teams on control design and risk trade-offs

Create and manage exception registry

Establish and maintain a risk register; track identified risks through remediation or acceptance

Manage the security exception process, including intake, review, approval, and tracking

Own risk reporting to leadership, risk committees, and the board as needed

Audit & Compliance

Serve as primary point of contact for internal and external security audits

Respond to customer security questionnaires and due diligence requests

Support certification and compliance efforts (SOC 2, ISO 27001, etc.)





Contribute to and help build the organization's security strategy and roadmap

Identify emerging risks and recommend program improvements

Cyber Program Delivery Overview Contributing, tracking and monitoring delivery of key cyber programs aligned to Cyber strategy and roadmap.

Ensure costs are captured and reported on a timely basis

Assist on all cyber events as it pertains to investigation, coordinating, and reporting

WHAT YOU BRING TO THE ROLE:

8+ years in information security, with 3+ years in a governance, risk, or advisory leadership role

Strong knowledge of security frameworks (NIST CSF, ISO 27001, SOC 2, CIS Controls)

Experience running risk registers, exception processes, and vendor risk programs

Experience with audits and customer security due diligence

Strong communication skills; able to translate technical risk for executive audiences

Relevant certifications preferred (CISSP, CISM, CRISC)

WHAT WE OFFER:

Health and Dental Benefits

This is for a current role.

Navacord

DOES NOT

utilize artificial intelligence in the screening, assessment, or selection of applicants for this position

#J-18808-Ljbffr

📌 Director Information Security (Winnipeg)
🏢 Navacord
📍 Winnipeg