Don’t miss this opportunity! Submit your application by November 6, 2026 to be considered for this exciting opportunity.

Job Title: Partner, Cybersecurity Governance, Risk and Compliance

Department: IT - Operations

Location: YUL

Reporting Manager: Director, IT Operations, Infrastructure and Security Reporting to the Director, IT Operations, Infrastructure and Security. The Partner, Cybersecurity Governance, Risk & Compliance will be responsible for establishing and enforcing cybersecurity governance across strategic transformation initiatives (Juniper, CRM, CDP), while designing and implementing a structured cybersecurity framework for Air Canada Vacations aligned with industry standards (NIST or ISO 27002). This is a 24-month temporary, onsite positionn WHAT YOU'LL BE DOING Cybersecurity Governance for Strategic Programs - Establish security governance structures for Juniper (Reservation System), CRM, CDP - Implement:

- Security checkpoints and stage gates - Risk and compliance reviews within project lifecycle - Ensure alignment with:
- Privacy requirements (PIA, data retention, etc.) - Architecture and Change Management processes - Enforce “secure by design” governance across all initiatives Cybersecurity Framework Development - Design and implement an enterprise cybersecurity framework for ACV based on NIST Cybersecurity Framework or ISO 27001 / 27002 controls - Define:
- Control domains and control catalog - Security standards and procedures - Governance and accountability model Policy & Directive Modernization - Review, rationalize, and modernize Cybersecurity policies, directives and procedures - Align policies:
- With Air Canada corporate standards where applicable - Reflect contemporary architectures (cloud, SaaS, APIs)



- Establish clear policy lifecycle and governance model/ Enterprise Asset Management & Data Classification - Define and implement:
- Enterprise asset inventory (applications, systems, data) - Data classification model (e.g., confidential, regulated, internal) - Identify:
- Critical systems and business assets - Sensitive and regulated data sets - Ensure classification drives Access controls, Retention policies, and Security controls Risk Management & Compliance - Establish cybersecurity risk management framework:
- Risk identification and assessment - Risk tracking and remediation - Formalize exception and risk acceptance processes AI Governance & Responsible Use - Define and implement AI governance framework including:
- AI usage policies and directives - Risk and compliance controls for AI systems - Data usage and model governance standards - Establish:
- Approval process for AI use cases - Monitoring and audit mechanisms for AI solutions - Ensure alignment with Air Canada enterprise policies (where applicable) WHAT YOU BRING TO THE TEAM - 8–12+ years in Cybersecurity governance / GRC and Risk management / Compliance - Certifications required (CISSP and / or CISM) - CRISC, an asset - ISO 27001 Lead Implementer or Lead Auditor, an asset - NIST Cybersecurity Framework Training Certification, an asset - CDMP, an asset - Proven experience:
- Implementing NIST or ISO frameworks - Supporting large transformation programs - Establishing governance models - Exposure to AI/data governance initiatives - Good understanding of:
- Data governance and classification - AI governance concepts (risk, ethics, controls) - Cloud and SaaS environments - Extremely organized and diligent in maintaining consistency - Autonomous and dedicated - Excellent communicator - Results oriented and the ability to manage multiple priorities with a sense of urgency and orientation to deadlines

📌 Partner, Cybersecurity Governance, Risk and Compliance (24 Month Contract) (Montreal)
🏢 Vacances Air Canada / Air Canada Vacations
📍 Montreal