Select how often (in days) to receive an alert:

Title: Senior Director, Technology Risk Assessments

Requisition ID: 278455
Join a purpose driven winning team, committed to results, in an inclusive and high-performing culture.

Scotiabank is seeking a transformational senior leader to modernize how technology and cybersecurity risks are assessed across the Bank. Reporting to the Vice President, IT Governance & Risk Oversight within the Office of the Chief Information Officer, the Senior Director, Technology Risk Assessments leads Scotiabank's global first-line technology and cybersecurity assessment capability relating to the Bank’s Threat Risk Assessments and Vendor Security Review processes.

The Senior Director brings the Bank's Threat Risk Assessment and Vendor Security Review processes under one leadership responsibility, creating an integrated approach to assessing internally developed technology solutions and third-party technology services. Together, these form an integrated Assessment Authority: one first-line capability for technology and cybersecurity assessment that preserves specialized expertise while introducing common leadership and strategic direction, coordinated intake and triage, consistent assessment methods and risk language, shared evidence and quality principles, reusable platform and security patterns, stronger risk reporting and traceability, modern workflows and structured data, and progressive use of artificial intelligence (AI) and automation.

This role is broader than traditional assessment delivery. It is an enterprise leadership and transformation opportunity to turn fragmented, document-heavy processes into an integrated, risk-based and evidence-informed assessment lifecycle.



It brings together technology risk, cybersecurity, security advisory, third-party risk, cloud and AI security, Governance, Risk and Compliance (GRC) modernization, adoption of ServiceNow Integrated Risk Management (IRM), data and automation, and leadership of a global team.

You will shape and lead six connected themes:

- Integrated Assessment Authority: One accountable leadership model for Threat Risk Assessment (TRA) and Vendor Security Review (VSR), with common direction, methods and risk language across specialized assessment teams.
- Shift-left security assessment: Technology and cybersecurity risks identified and addressed earlier in architecture, design and delivery, when they are least costly to resolve.
- Platform and application assessment: A two-level model that assesses shared platforms once and focuses application and vendor assessments on what is genuinely specific.
- Evidence-informed risk decisions: Risk conclusions grounded in structured, verifiable evidence and consistent rating criteria rather than document volume.
- Up-to-date workflow, data and automation: Assessments run through modern ServiceNow IRM workflows, supported by structured data and the progressive use of AI and automation.
- Portfolio risk insight: Clear,



traceable reporting that surfaces recurring and systemic risks across the Bank's technology and third-party portfolio.

The platform and application model works at two levels:

- Horizontal assessments evaluate common platforms, shared services and approved technology patterns once, so related controls and evidence can be reused.
- Vertical assessments evaluate the application, workload, project, vendor or material change, and focus on specific deviations, exposures and residual risks

Is this role right for you? In this role, you will:

- Lead the existing TRA and VSR capabilities under one senior leadership model, preserving specialized expertise while establishing common direction, coordinated intake and triage, and shared standards.
- Define and maintain consistent assessment methodology, risk-rating criteria, quality requirements, evidence principles and finding taxonomies, aligned to the Bank's technology control objectives and enterprise control library and to recognized frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), ISO/IEC 27001 and the Payment Card Industry Data Security Standard (PCI DSS).
- Embed technology and cybersecurity assessment earlier in architecture, design and technology delivery, including the Bank's delivery framework, architecture review processes and Continuous Integration and Continuous Delivery (CI/CD) pipelines.
- Establish reusable security and platform patterns that allow downstream assessments to inherit approved baselines.
- Assess material application-specific and vendor-specific risks, including data, identity, integration, architecture, exposure and residual risk.
- Strengthen threat modelling and scenario-based risk analysis

📌 Senior Director, Technology Risk Assessments (Toronto)
🏢 Scotiabank
📍 Toronto