Cybersecurity Risk & Controls Specialist - Risk Metrics and CCM

Cybersecurity Metrics & Controls Specialist – Cybersecurity Controls, Metrics, Risk & Continuous Controls Monitoring (CCM)

Location:

Montreal

Work Model:

Hybrid – 3 days per week in office

Role Summary

The successful candidate will join the Continuous Controls Monitoring (CCM) team and be part of the Metric Design & Architecture team.

The team quantifies and reports on the implementation correctness and operating efficiency of Technology controls.

Key Responsibilities

• Establish and document control/risk metric definitions for Technology controls by engaging with stakeholders, understanding processes, and analyzing data for accurate measurement.

• Engage with the Technology Policy team to ensure control measurement/metric requirements are met through policy design and update processes.

• Partner with various metric consumers to establish reporting frameworks that meet business requirements.

• Partner closely with the CCM Data Acquisition and Tooling team for successful implementation of metrics.

Required Skills & Experience

• 10+ years of experience in Information Security and/or Information Technology.

• 5+ years of hands-on experience with technology or cybersecurity control implementations.

• Ability to define metrics/Key Control Indicators (KCIs) to demonstrate control implementation completeness.

• Strong business acumen and strategic mindset.

• Experience working with and understanding the needs of customers or clients.

• Strong interpersonal skills with the ability to interact effectively at all levels and collaborate across teams.

• Ability to manage expectations and work effectively under tight deadlines and high-pressure situations.

• Proven analytical and decision-making skills based on quantitative and qualitative data.

• Knowledge of various Technology Control and Cybersecurity domains.

• Knowledge of Public Cloud technologies.

• Knowledge of security concepts and tools related to:

• Identity & Authentication

• Data Security

• System Security

• Network Security

• Application Security

• Knowledge of security logging, monitoring, and incident response.

Preferred Qualifications

• Cybersecurity certifications are preferred.