CoreFactor is searching for a Senior Manager Cyber Security Governance on a permanent/full-time basis for a client in the GTA.
This position is hybrid and will require the successful incumbent to go into the office two (2) days per week.
The Manager Cyber Security Governance is a key resource that will be responsible for contributing and executing a strategy roadmap that matures the organizations cyber security capabilities. The successful candidate will have knowledge of principles in cyber security policies and standards and modern practices with a good understanding of governance models that support the review and reporting of organizational risks. As a member a dedicated Cyber Security team the Sr Manager Cyber Security Governance works closely with senior leadership team members and staff across Risk Audit Legal HR Fraud Operations and Infrastructure teams to ensure the organization is operating securely.
Accountabilities:
- Proactively lead the implementation of governance initiatives providing technical and business advice as well as insight on governance processes.
- Preparing and maintaining risk register that identifies risk areas and themes to report on the activities for risks issues and remediation progress.
- Enhancing and maintaining the security risk assessment framework.
- Aligning and refining Cyber Security policies and standards with industry best practices pertinent to regulations and standards bodies (NERC CIP ISO 27001/2 PCI DSS CIS NIST Series)
- Prepare track maintain and report risk acceptances and security exceptions.
- Leverage expertise in Cyber Security Management to prepare and conduct security assessments for both planned initiatives and unplanned instances as required.
- Weigh business needs against security concerns to help guide the business to make practical and informed risk decisions.
- Review technical documents in line with company policies.
- Report and measure through Metrics the effectiveness of the technical controls (KPI/KRI) and propose compensating controls accordingly.
- Proactively contribute to security governance initiatives providing technical and business advice as well as insight on management processes.
- Implement and enforce the Cyber Security policies and standards with industry best practices pertinent regulations and standards bodies (NERC CIP ISO 27001/2 PCI DSS CIS NIST Series)
- Support the development and documentation of security processes to support risk management activities across the lifecycle in the SDLC vendor management office project management office risk acceptance.
- Developing security requirements matrix mapped to organizations policies and standards.
- Examine and interpret requirement documents and architecture diagrams and determine security risks to the organization as required.
- Collaborate with senior leaders and make informed risk-based recommendations to enhance the security posture of the organization products and services.
- Weigh business needs against security concerns to help guide the business to make practical and informed risk decisions.
- Participate and support security related initiatives and serve as a key interface with external and internal auditors for security compliance related activities.
- Keep abreast of the cybersecurity threats and assess their potential impact to the organizations security posture. Lead and manage a team to achieve business objectives and goals.
- Provide guidance support and mentorship to team members to help them develop their skills and reach their full potential.
- Set performance expectations and goals for team members and regularly provide feedback on their progress towards meeting those expectations.
- Manage the recruitment onboarding and training of new team members.
- Foster a positive and collaborative team setting that encourages open communication and teamwork. Identify and address any issues or conflicts within the team and work to resolve them in a timely and effective manner.
- Collaborate with other teams and departments to ensure alignment and efficient execution of company initiatives.
- Develop and implement strategies to improve team performance productivity and engagement.
- Ensure compliance with company policies procedures and regulations.
- Conduct regular performance reviews and assessments and make recommendations for promotions transfers or disciplinary actions as needed.
Requirements
- Bachelors degree in computer science information security or a related field.
- Minimum 7 years in Cyber Security leadership/senior management/senior roles preferably within the electric/energy utility sector or other large/multi-national organization.
- Security certification of one or more of the following: CISSP CISA CISM or other security certification knowledge of industry standards and best practices for cyber risk management including NIST ISO and COBIT.
- Demonstrated ability to build and implement new processes for governance frameworks and processes. Experience in consulting stakeholders with complex business transformation technical advisory and cyber risk strategy underpinned by a deeper subject matter expertise in one or more cybersecurity domains.
- Consistent record of developing and improving the security posture of enterprise and ICS/OT organization.
- Strong leadership and analytical skills with a record of people development and technical delivery.
- Maintain in-depth awareness and understanding of current and emerging cyber security threat risk and trends. Background in NERC CIP CSAE3416 SOC 2 PCI DSS and ITIL is an asset.
- Excellent communication skills both verbal and written.
- Ability to collaborate effectively with cross-functional teams.
Required Skills:
Bachelors in computer science or engineering. 5-10 years in a Network Specialist position (Required) 5 years in security. Network and security certifications CCIE CCNP or CISSP would be an asset. Extensive experience with network VOIP systems and security TCP/IP Routing protocols DNS DHCP VPNs and Encryption authentication Wireless Cisco ASA firewalls IPS/IDS VOIP Cisco UCS. 3 Experience working with network including routers and switches public domain name system public key interchanges and encryption technology. Knowledge and experience working on cloud technologies AWS Office 365 Azure or similar technologies and IaaS or SaaS deployments. Experience and knowledge with network monitoring intrusion detection and prevention and security information and event management (SIEM) tools. Nice to have Good understanding of server technologies. Experience in data security and encryption BCP/DRP privacy and confidentiality. Effective oral and written communication skills; ability to explain basic technical concepts to nontechnical audiences. Ability to adapt to an ever-changing environment and multitasking on several tasks/projects. Strong problem-solving and critical thinking skills Analytical and synthesis skills. Strong organizational skills. Driven and result-oriented