Manager, IT, GRC and Security

Responsibilities

• Leads the enterprise IT governance and compliance program, and develops, maintains, and periodically reviews technology policies, standards, procedures, and control frameworks aligned to recognized frameworks and CSA's risk appetite.
• Maintains the control library, mapping controls to policy, framework, contractual, customer, and regulatory obligations to avoid duplicate testing, and validates through assurance activity that controls are implemented and operating effectively.
• Facilitates technology and cybersecurity risk assessments across the technology estate, projects, and third parties, and maintains the risk register, ensuring mitigation and remediation plans are tracked to closure.
• Operates the risk acceptance and control exception process, and provides risk input into project charters, architecture decisions, change management, and technology investment decisions.
• Oversees compliance with internal policies, contractual obligations, customer requirements, and regulatory and privacy requirements, and plans and executes IT self-assessments and control testing.
• Coordinates internal and external audits and certification or attestation activity, including scoping, evidence collection, management responses, and remediation of findings, and maintains the compliance calendar and evidence repository.
• Oversees security assessments of applications, systems, cloud services, and vendors, and leads the penetration testing and security assurance program, including provider selection, finding triage, and retest verification.
• Leads third-party and supply chain security risk management, including due diligence, criticality tiering, ongoing monitoring, and secure offboarding.
• Manages customer security questionnaires, due diligence requests, and customer-led audits, and reviews customer and vendor contracts for alignment with IT policies and the governance framework.
• Governs the enterprise disaster recovery and technology resilience program, ensures plans and RTO/RPO objectives are established and validated through testing, and reports on status and gaps to ITLT and executive leadership.
• Ensures cybersecurity incident response plans, playbooks, and escalation paths are documented, exercised, and understood, and coordinates governance, reporting, and post-incident corrective action for significant incidents.
• Governs the reporting and remediation performance of vulnerability management, security monitoring, and threat management activities performed by delivery teams.
• Builds organizational cybersecurity awareness and owns the security awareness and training program, including phishing simulation and role-based training.
• Establishes priorities, delivery plans, and performance expectations for the governance, risk, compliance, and assurance program, and directs assigned resources and third-party assessors who do not report to the role.
• Manages GRC and assurance budgets, vendor relationships, and contracts, and holds managed security service providers and cyber assurance partners accountable to agreed scope and service levels.
• Serves as a trusted advisor to technology leadership and business stakeholders, and presents cybersecurity and risk status, trends, and significant issues to ITLT and executive leadership in business language.
• Provides coaching, technical direction, and development support to the GRC Senior Associate and other staff performing governance, risk, and compliance work.
• Completes special projects and reports as required.

Education & Experience

Skills

• Working expertise in ISO/IEC 27001 and 27002, the NIST Cybersecurity Framework, NIST SP 800-53, COBIT, CIS Controls, and SOC 2 Trust Services Criteria, with the ability to map and rationalize controls across them.
• Working knowledge of privacy and data protection requirements relevant to a global organization (PIPEDA, Quebec Law 25, EU/UK GDPR, applicable US state privacy legislation) sufficient to assess technology impact and work with Legal and Privacy.
• Knowledge of security control implementation across infrastructure, applications, identity, cloud platforms (Microsoft Azure and Microsoft 365), and third-party services, sufficient to challenge control design and validate operating effectiveness.
• Experience with GRC, risk register, policy management, and evidence automation tooling, and with vulnerability and compliance reporting.
• Familiarity with accreditation and conformity assessment requirements applicable to a testing, inspection, and certification body (ISO/IEC 17025, 17020, 17065) considered an asset.
• Excellent problem resolution, influencing, and negotiation skills, with a demonstrated ability to drive outcomes through teams that do not report to the role.
• Excellent written and oral communication skills, including the ability to present technical risk to executive audiences in business terms.
• Must demonstrate good judgment, sound decision-making, and discretion in handling confidential information, including audit findings, control weaknesses, and incident detail.
• Accreditations considered an asset: CISSP, CISM, CRISC, CISA, ISO/IEC 27001 Lead Implementer or Lead Auditor, CGEIT, COBIT, or related risk, governance, or cybersecurity certifications.
• Must be willing to travel to CSA Group locations for assessments, audits, testing, and stakeholder engagement.
• This is a hybrid position requiring regular in-person attendance and punctuality in accordance with Company policies. Additionally, the ability to interact well with other employees and work overtime, as necessary, is required.
• The typical hiring range for this position is $116,230 - $152,555, however, based on a variety of considerations (such as education, licenses, certifications and/or experience,) CSA Group reserves the right to flexibility outside of the stated range.