Lead Information Security Analyst, Vulnerability and External Attack Surface Management (T & I) (Telework/Hybrid)

• University degree in computer science, IT or information security.
• Minimum five years' experience in vulnerability management, risk assessment or IT governance, including at least three years in an information security role.
• Extensive knowledge of security technology and risk assessment methodologies, policies and processes.
• Excellent written and verbal communication skills, with a demonstrated ability to translate complex technical concepts for non-technical decision-makers (e.g., governance committees, business units, legal teams).
• Excellent analytical, evaluative and problem-solving abilities.
• Experience with compliance programs as well as their technical and security requirements.
• Technical expertise across key domains: Standards and Frameworks: Strong command of industry standards such as ISO/IEC 27001, 27002, 27005, NIST SP 800-53 / 800-161, COBIT and ITIL. Cloud and Web Architecture Security: Solid understanding of web infrastructure and cloud environment security. Network and Security Technologies: Thorough understanding of network architectures (LAN/WAN, routers), network security technologies (firewalls, IDS/IPS, DNS, web filtering) and cryptographic principles (encryption at rest and in transit). Architecture and Data Security: Working knowledge of database architecture concepts and secure software development best practices. Operational Resilience and Physical Security: Solid understanding of business continuity and disaster recovery planning (BCP/DRP), operational resilience and physical security controls.
• Standards and Frameworks: Strong command of industry standards such as ISO/IEC 27001, 27002, 27005, NIST SP 800-53 / 800-161, COBIT and ITIL.
• Cloud and Web Architecture Security: Solid understanding of web infrastructure and cloud environment security.
• Network and Security Technologies: Thorough understanding of network architectures (LAN/WAN, routers), network security technologies (firewalls, IDS/IPS, DNS, web filtering) and cryptographic principles (encryption at rest and in transit).
• Architecture and Data Security: Working knowledge of database architecture concepts and secure software development best practices.
• Operational Resilience and Physical Security: Solid understanding of business continuity and disaster recovery planning (BCP/DRP), operational resilience and physical security controls.
• Relevant professional security certifications a definite asset (e.g., CISSP, CRISC, CBCP, CISA, CISM or equivalent).
• Bilingualism (English and French) essential.

Candidates may be subject to skills and knowledge testing.

We thank all applicants for their interest, but only candidates selected for an interview will be contacted.

As part of our recruitment process, candidates who advance to the next

step will be asked to complete a background check.

This includes:

• A mandatory Criminal record check.
• Other background checks may be conducted based on the operational requirements of the position.

CBC/Radio-Canada is committed to being a leader in reflecting our country’s diversity.

That’s because we can only create and tell the stories that connect Canadians, by having a workforce that mirrors the ever-changing makeup of our country.

That’s why we, as an employer, value equal opportunity and nurture an inclusive workplace where our individual differences are not only recognized and valued, but also extend to and pervade all the services we provide as Canada’s public broadcaster.

For more information, visit the Diversity and Inclusion section of our website.

If you have accommodation needs at this stage of the recruitment process, please inform us as soon as possible by sending an e-mail to recruitment@cbc.ca .

You are invited to consult and familiarize yourself with our Code of Conduct, which can be found on our corporate website .

All employees must adhere to the Code as a condition of employment.

We also invite you to take a look at our policy on conflicts of interest .

In the event that you become an employee, it will be important to inform us, as quickly as possible, of any situation that, because of your hiring, constitutes or could appear to constitute a conflict of interest.

Number of Openings: