At CAAT, we’re passionate about what we do. And it showsHere, you’ll find a cultural spark in everything we do – from the way we partner with members and employers, to the way we work, collaborate, and grow. It doesn’t just feel different at CAAT. It is different. We’re one of the fastest-growing pensions in the country for a reason. We challenge the status quo, making a real impact on the hundreds of employers we serve – from education institutions to major corporations and household brands. And we’re just getting started. Driven by core values and a shared purpose, we’re fierce champions for better retirement security, known for our can-do culture where everyone plays a role in bringing our vision to life. If this sounds like a fit, we’d love you to be a part of it.

About the Role
Reporting to the Senior Director, Cybersecurity Operations and Vulnerability Management, the Senior Manager, Security Operations & Vulnerability Management leads CAAT’s enterprise security operations, threat detection, incident response, offensive security, SOC modernization, vulnerability lifecycle management, and cyber resilience programs. The successful incumbent will be overseeing and maturing CAAT’s Security Operations Centre (SOC), leading advanced threat hunting, orchestrating major incident response activities, and ensuring robust vulnerability identification, prioritization, and remediation across applications, infrastructure, and cloud environments.
As the Newest Member of our Team, You’ll:Develop and execute SOC modernization roadmap including AI-enabled analytics, automation, cloud-native monitoring, and detection-as-code adoption.
Define and manage KPIs, KRIs, and maturity metrics for threat detection and incident response,



and vulnerability exposure reductionProvide planned oversight over operational security engineering, aligning SOC capabilities with business risks, technology roadmaps, and enterprise objectivesBuild and oversee a scalable 24/7 SOC operating model, including staffing strategy, SLAs, escalation pathways, and operational coverage.
Partner with enterprise architecture, infrastructure, cloud, and DevOps teams to embed security-by-designLead analysis of emerging threats, AI-enabled attacks, supply-chain risks, and cloud-native exploitation trends.
Govern daily SOC performance ensuring continuous improvementServe as incident commander for major security events while overseeing the enterprise-wide incident response program, including playbook development, escalation processes, and forensics readiness.
Oversee high-quality forensic investigations and post-incident reviews, integrating insights into architecture, operations, and governance to strengthen organizational resilience.
Ensure compliance with ISO27001/27002, NIST, CSF, ITIL, and relevant Canadian standards; lead audit and control validation, compliance effortsOversee MSSP (Managed Security Service Provider) contracts, performance monitoring,



and continuous service improvement and manage cybersecurity vendor relationships to ensure alignment with CAAT’s operational model and verify that third-party security services deliver measurable value and meet quality standardsLead red team adversary emulations and oversee purple team exercises to enhance detection fidelity and control effectiveness.
Lead the end-to-end vulnerability lifecycle across cloud, infrastructure, identity, network, applications, and SaaS, ensuring controls and misconfiguration management are integrated into CI/CD pipelines and the secure SDLC.
Deliver executive-ready reporting on threats, SOC performance, vulnerability trends, and cyber risk posture while clearly communicating complex security concepts to senior leadership and providing expert advisory to enable risk-based decision-making.
To Succeed, You Bring:A university degree or diploma in cybersecurity, computer science, or a related field, or an equivalent combination of education and experience.
A minimum of seven (7) to ten (10) years of progressive cybersecurity experience, including four (4) plus years in leadership roles managing SOC, DFIR (Digital Forensics and Incident Response), Threat Detection, and Vulnerability Management functions within mid-to-large enterprise environments.
CISSP (Certified Information Systems Security Professional) designation is requiredProven experience establishing, scaling, or managing a 24×7 or follow-the-sun SOC model, including staffing strategies, shift alignment, escalation models, and operational KPIs.
Robust background in offensive security practices, including red teaming, threat emulation, adversary simulation, or collaboration with penetration testing teams to inform defensive strategies.
Experience integrating AI/ML-driven security capabilities, such as automated threat detection models, AI-enhanced analytics, anomaly detection, or using AI tools to improve SOC efficiency and response accuracy.
Hands-on expertise with enterprise security technologies, including EDR/XDR, SIEM, SOAR, vulnerabil

📌 Senior Manager, Cybersecurity Operations (Toronto)
🏢 CAAT Pension Plan
📍 Toronto