Title: Senior Director, Technology Risk Assessments Scotiabank is seeking a transformational senior leader to modernize how technology and cybersecurity risks are assessed across the Bank. Reporting to the Vice President, IT Governance & Risk Oversight within the Office of the Chief Information Officer, the Senior Director, Technology Risk Assessments leads Scotiabank's global first-line technology and cybersecurity assessment capability relating to the Bank’s Threat Risk Assessments and Vendor Security Review processes.

The Senior

Director brings the Bank's Threat Risk Assessment and Vendor Security Review processes under one leadership responsibility, creating an integrated approach to assessing internally developed technology solutions and third-party technology services. Together, these form an integrated Assessment Authority: one first-line capability for technology and cybersecurity assessment that preserves specialized expertise while introducing common leadership and strategic direction, coordinated intake and triage, consistent assessment methods and risk language, shared evidence and quality principles, reusable platform and security patterns, stronger risk reporting and traceability, modern workflows and structured data, and progressive use of artificial intelligence (AI) and automation. It is an enterprise leadership and transformation opportunity to turn fragmented, document-heavy processes into an integrated, risk-based and evidence-informed assessment lifecycle.

It brings together technology risk, cybersecurity, security advisory, third-party risk, cloud and AI security, Governance, Risk and Compliance (GRC) modernization, adoption of ServiceNow Integrated Risk Management (IRM), data and automation, and leadership of a global team.

Integrated Assessment Authority: One accountable leadership model for Threat Risk Assessment (TRA) and Vendor Security Review (VSR), with common direction, methods and risk language across specialized assessment teams. Shift-left security assessment: Technology and cybersecurity risks identified and addressed earlier in architecture, design and delivery, when they are least costly to resolve. Evidence-informed risk decisions: Risk conclusions grounded in structured, verifiable evidence and consistent rating criteria rather than document volume.

Modern workflow, data and automation: Assessments run through modern ServiceNow IRM workflows, supported by structured data and the progressive use of AI and automation.

Portfolio risk insight: Clear, traceable reporting that surfaces recurring and systemic risks across the Bank's technology and third-party portfolio. Horizontal assessments evaluate common platforms, shared services and approved technology patterns once, so related controls and evidence can be reused. Vertical assessments evaluate the application, workload, project, vendor or material change, and focus on specific deviations, exposures and residual risks Lead the existing TRA and VSR capabilities under one senior leadership model, preserving specialized expertise while establishing common direction, coordinated intake and triage,



and shared standards.

Define and maintain consistent assessment methodology, risk-rating criteria, quality requirements, evidence principles and finding taxonomies, aligned to the Bank's technology control objectives and enterprise control library and to recognized frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), ISO/IEC 27001 and the Payment Card Industry Data Security Standard (PCI DSS). Embed technology and cybersecurity assessment earlier in architecture, design and technology delivery, including the Bank's delivery framework, architecture review processes and Continuous Integration and Continuous Delivery (CI/CD) pipelines. Assess material application-specific and vendor-specific risks, including data, identity, integration, architecture, exposure and residual risk.

Strengthen threat modelling and scenario-based risk analysis, using recognized approaches such as STRIDE and MITRE ATT&CK.; Act as the business owner for the technology-risk assessment capability within ServiceNow IRM, defining assessment requirements, workflows and data needs while working with the technical platform team, which owns platform configuration and delivery. Lead the assessment-domain transition from legacy processes and repositories into modern IRM workflows, preserving application-to-assessment and application-to-risk traceability and establishing clear data-quality requirements.

Define risk-based triggers for reassessment following material change, significant vulnerability, control failure or deviation from an approved pattern. Establish targeted post-implementation assurance for selected material controls, using authoritative evidence from accountable control owners and specialist functions. Prioritize appropriate AI and automation opportunities across intake, triage, context extraction, pattern matching, assessment drafting, evidence orchestration and portfolio insight, in alignment with the Bank's enterprise artificial intelligence and technology-risk automation initiatives.

Identify recurring and systemic risks across the assessment portfolio and provide explicit risk insight to technology leaders and governance forums. Produce assessment outcomes that are timely, consistent, traceable, evidence-informed and defensible for regulatory, second-line, quality assurance and Internal Audit review, including under the Office of the Superintendent of Financial Institutions (OSFI) Guideline B-13 and the New York State Department of Financial Services (NYDFS) Part 500 cybersecurity regulation, where applicable. Lead and develop a large, multidisciplinary and geographically distributed team, building capabilities in security advisory, cloud and AI security,



third-party security risk, methodology, data and automation..

Success depends on strong partnerships across the Bank's three lines of defense. Each partner keeps its established mandate, and the Senior Director works with them to ensure that assessment conclusions are well-informed and aligned.

Technology leadership: The Office of the Chief Information Security Officer (CISO) and Enterprise Architecture, to align security standards, patterns and design guidance. Teams that implement and operate controls, and the Bank's technology control testing function, whose evidence informs assessment conclusions.

Technology risk management: Technology risk teams and Risk and Control Self-Assessment (RCSA) teams, which manage and aggregate technology risk across the Bank.

Platform and automation: The ServiceNow IRM platform and implementation teams, and the Bank's enterprise artificial intelligence and technology-risk automation initiatives, to ensure aligned workflows and data. IT risk governance, issue management and reporting teams within the Office of the Chief Information Officer. Second-line risk management, Internal Quality Assurance (IQA) and Internal Audit, which provide independent challenge and assurance, and the teams that manage the Bank's regulatory relationships University degree in Computer Science, Engineering, Information Security or a related field. ~10+ years of progressive experience in technology risk, cybersecurity or risk assessment, including senior leadership of technology or cybersecurity risk assessment functions. ~ Strong experience in third-party and vendor security risk, and in cloud, AI, application and platform security. ~ A track record of leading enterprise GRC transformation, including with ServiceNow IRM or a comparable GRC platform, from business requirements through adoption. ~ Experience engaging regulators and Internal Audit in a highly regulated environment, ideally financial services. ~ Proven ability to lead large, distributed teams and to lead through influence across federated organizations and with senior technology executives.

Advanced degree or professional certifications such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC) or Certified Information Security Manager (CISM).

Experience leading platform- and pattern-based assessment models that allow controls to be inherited across applications and workloads. Hands-on experience with risk data, evidence orchestration and workflow automation, including integrations with security tooling. Familiarity with AI, machine learning and agentic AI applications in GRC, such as intake triage, artifact analysis, control mapping and risk-theme identification.

Experience applying structured risk-rating criteria, calibration and quantitative risk techniques.

Experience partnering with control-testing functions to integrate authoritative control evidence into risk assessment, ideally within a large financial institution

📌 Senior Director, Technology Risk Assessments (Toronto)
🏢 Scotiabank
📍 Toronto