Technology Risk Vice President

Role Overview

Security Architecture and Technology Risk

• Conduct security reviews of infrastructure, applications, cloud environments, networks, databases, middleware, and security solutions.
• Review technology solutions and architectures to ensure security requirements are incorporated by design.
• Perform threat modelling and security risk assessments for new technologies and business initiatives.
• Define and assess security baselines and configuration standards.
• Provide security recommendations for enterprise architecture and technology transformation initiatives.

Cloud, AI, and Emerging Technology Security

• Assess security controls across Microsoft Azure, Google Cloud Platform, and Oracle Cloud Infrastructure.
• Conduct cloud security assessments covering identity, networks, workloads, containers, data protection, logging, and monitoring.
• Support security governance for container environments.
• Assess AI, generative AI, machine learning, and emerging technology solutions.
• Assess controls and compliance requirements for AI-powered applications and third-party AI service providers.
• Establish controls for cloud-native, AI-enabled, and emerging technology environments.

Application Security and DevSecOps

• Lead application security assessments throughout the software development lifecycle.
• Establish and enhance secure SDLC and DevSecOps practices.
• Integrate security testing and controls into CI/CD pipelines.
• Oversee SAST, DAST, SCA, penetration testing, and application security reviews.
• Work with development teams to identify and remediate application security vulnerabilities.
• Promote security-by-design principles across application development and technology projects.

Vulnerability and Security Testing

• Oversee enterprise vulnerability management and risk-based vulnerability remediation.
• Manage penetration testing activities for applications, infrastructure, and external-facing systems.
• Coordinate internal and external penetration testing engagements and track remediation.
• Establish vulnerability management KPIs, KRIs, risk acceptance processes, and remediation timelines.
• Facilitate vulnerability remediation governance forums where required.
• Identify recurring vulnerabilities and drive improvements to the organization’s security posture.

Security Operations and Incident Management

• Provide governance and oversight of security monitoring and incident response capabilities.
• Work with SOC and security operations teams to improve detection, response, and remediation processes.
• Review SIEM use cases, security monitoring requirements, and incident management processes.
• Support major cybersecurity incident investigations and post-incident improvement activities.
• Ensure incident lessons learned are incorporated into security controls and risk management processes.

Governance, Risk, Compliance, and Assurance

• Act as deputy to the Information Security Officer when required.
• Support cybersecurity governance, risk management, compliance, and assurance activities.
• Prepare presentations, reports, action tracking, metrics, dashboards, KPIs, KRIs, and management reporting materials.
• Support internal, external, and regulatory audits through evidence collection, coordination, findings tracking, and remediation monitoring.
• Perform cybersecurity assurance activities and control effectiveness reviews.

Requirements

• Demonstrated experience in cybersecurity risk management, security assurance, and technical security expertise.
• Ability to assess complex technology environments and security controls.
• Ability to engage effectively with business stakeholders, technology teams, project managers, third-party providers, auditors, and regulators.
• Experience supporting cybersecurity governance, risk management, compliance, and assurance activities.
• Experience with cloud, AI, application security, DevSecOps, vulnerability management, and security testing domains.