We are hiring an Assistant Vice President, Information Security

Reporting To: VP, Technology Governance, Risk and Performance

Full-Time/Part- Time: Full-time

Posting Date: September 21, 2026

Closing Date: October 26, 2026

Hours of Work: 8:30 a.m. - 5:00 p.m.

Grade: 20.4

Office Location: Toronto, ON - Outstanding location Steps away from the main public transit station

The Offer

Highly competitive compensation package which includes, base salary, bonus, benefits, and career advancement opportunities

- Eligibility for benefits is dependent on the terms of employment

The Opportunity

The Assistant Vice President, Information Security is First National’s enterprise cybersecurity leader within Product and Technology. The role sets cybersecurity direction, operates the Information Security function, improves cyber resilience, and enables secure delivery across applications, infrastructure, cloud, identity, data, integrations, and AI.

The AVP combines technical credibility with executive leadership, sound risk judgment, and disciplined execution. The role initially reports to the Chief Product and Technology Officer and is expected to transition to the Vice President, Technology Governance, Risk and Performance as the target operating model is established, while retaining direct escalation access to the CPTO for material cyber incidents or risk exposures.

How you will contribute:

Cybersecurity Strategy, Governance and Assurance

- Define and execute the cybersecurity strategy and capability roadmap aligned to business priorities, technology modernization, risk appetite, client obligations, and the Product and Technology operating model.





- Serve as the senior cybersecurity authority within Product and Technology, advising executives and governance forums on material risk, incidents, exceptions, investment priorities, and security performance. Operate first line cyber risk management while accountable business and technology owners remain responsible for remediation and residual risk decisions within delegated authority.

- Maintain and continuously improve the Information Security Management System, policies, standards, control requirements, cybersecurity compliance activities, and performance measures. Maintain strong ISO 27001 aligned practices and support applicable regulatory, contractual, client, and internal policy requirements.

- Lead the Information Security responsibilities for SOC 1 and SOC 2 audits and attestations, including security control ownership, evidence readiness, management responses, remediation, and external auditor support, in partnership with Technology Governance, Risk and Performance.

- Own the security response to client questionnaires, due diligence, audits, assurance reviews, and control assessments from third party underwriting and servicing clients and strategic partners. Act as the senior security contact for client security teams and maintain reusable approved responses, control narratives, and evidence to improve speed and consistency.

Security Operations,



Incident Response & Cyber Resilience

- Lead security monitoring, managed detection and response, threat intelligence, detection engineering, incident response, and digital forensics coordination, with clear service levels and performance expectations for managed security providers.

- Lead the technical cyber response during material incidents and coordinate with technology, business, legal, privacy, communications, risk, and other enterprise leaders on crisis management, notification, service recovery, and business continuity actions.

- Maintain and test cyber incident playbooks, executive and technical exercises, and recovery scenarios, using incidents, threat intelligence, control testing, and exercises to drive continuous improvement and tracked corrective actions.

Security Engineering, Identity, Cloud and Application Security

- Define practical security architecture standards, reusable patterns, Zero Trust principles, and minimum control requirements across cloud, infrastructure, networks, end user computing, applications, APIs, integrations, data platforms, and emerging technology.

- Set identity security requirements across authentication, privileged access, access governance, conditional access, service identities, secrets, certificates, and excessive or persistent access, while partnering with Enterprise IT and Infrastructure on endpoint, network, cloud, logging, backup, and hardening controls.

- Embed security into engineering practices and delivery pipelines through secure coding, threat modelling, dependency and secrets scanning, SAST, DAST, penetration testing, API security, software sup

📌 Assistant Vice President, Information Security (Canada)
🏢 First National Financial
📍 Canada