Don’t miss this opportunity! Submit your application by November 6, 2026 to be considered for this exciting opportunity.

Job Title: Partner, Cybersecurity Governance, Risk and Compliance

Department: IT - Operations

Location: YUL

Reporting Manager: Director, IT Operations, Infrastructure and Security

Reporting to the Director, IT Operations, Infrastructure and Security. The Partner, Cybersecurity Governance, Risk & Compliance will be responsible for establishing and enforcing cybersecurity governance across strategic transformation initiatives (Juniper, CRM, CDP), while designing and implementing a structured cybersecurity framework for Air Canada Vacations aligned with industry standards (NIST or ISO 27002).

This is a 24-month temporary, onsite positionn

WHAT YOU'LL BE DOINGCybersecurity Governance for Strategic Programs

- Establish security governance structures for Juniper (Reservation System), CRM, CDP
- Implement:
- Security checkpoints and stage gates
- Risk and compliance reviews within project lifecycle

- Ensure alignment with:

- Privacy requirements (PIA, data retention, etc.)
- Architecture and Change Management processes

- Enforce “secure by design” governance across all initiatives

Cybersecurity Framework Development
- Design and implement an enterprise cybersecurity framework for ACV based on NIST Cybersecurity Framework or ISO 27001 / 27002 controls
- Define:
- Control domains and control catalog
- Security standards and procedures
- Governance and accountability model

Policy &

• Directive Modernization

- Review, rationalize, and modernize Cybersecurity policies, directives and procedures
- Align policies:
- With Air Canada corporate standards where applicable
- Reflect modern architectures (cloud, SaaS, APIs)

- Establish transparent policy lifecycle and governance model

Enterprise Asset Management &





• Data Classification

- Define and implement:
- Enterprise asset inventory (applications, systems, data)
- Data classification model (e.G., confidential, regulated, internal)

- Identify:

- Critical systems and business assets
- Sensitive and regulated data sets

- Ensure classification drives Access controls, Retention policies, and Security controls

Risk Management &

• Compliance

- Establish cybersecurity risk management framework:
- Risk identification and assessment
- Risk tracking and remediation

- Formalize exception and risk acceptance processes

AI Governance &

• Responsible Use

- Define and implement AI governance framework including:
- AI usage policies and directives
- Risk and compliance controls for AI systems
- Data usage and model governance standards

- Establish:

- Approval process for AI use cases
- Monitoring and audit mechanisms for AI solutions

- Ensure alignment with Air Canada enterprise policies (where applicable)

WHAT YOU BRING TO THE TEAM
- 8–12+ years in Cybersecurity governance / GRC and Risk management / Compliance
- Certifications required (CISSP and / or CISM)
- CRISC, an asset
- ISO 27001 Lead Implementer or Lead Auditor, an asset
- NIST Cybersecurity Framework Training Certification, an asset
- CDMP, an asset
- Proven experience:
- Implementing NIST or ISO frameworks
- Supporting large transformation programs
- Establishing governance models
- Exposure to AI/data governance initiatives

- Good understanding of:

- Data governance and classification
- AI governance concepts (risk, ethics, controls)
- Cloud and SaaS environments

- Extremely organized and diligent in maintaining consistency
- Autonomous and dedicated
- Excellent communicator
- Results oriented and the ability to manage multiple priorities with a sense of urgency and orientation to deadlines

📌 Partner, Cybersecurity Governance, Risk And Compliance (24 Month Contract) (Montreal)
🏢 Vacances Air Canada / Air Canada Vacations
📍 Montreal