Senior Director, Technology Risk Assessments

Select how often (in days) to receive an alert:

Title: Senior Director, Technology Risk Assessments

Requisition ID: 278455
Join a purpose driven winning team, committed to results, in an inclusive and high-performing culture.

Scotiabank is seeking a transformational senior leader to modernize how technology and cybersecurity risks are assessed across the Bank. Reporting to the Vice President, IT Governance & Risk Oversight within the Office of the Chief Information Officer, the Senior Director, Technology Risk Assessments leads Scotiabank's global first-line technology and cybersecurity assessment capability relating to the Bank’s Threat Risk Assessments and Vendor Security Review processes.

The Senior Director brings the Bank's Threat Risk Assessment and Vendor Security Review processes under one leadership responsibility, creating an integrated approach to assessing internally developed technology solutions and third-party technology services. Together, these form an integrated Assessment Authority: one first-line capability for technology and cybersecurity assessment that preserves specialized expertise while introducing common leadership and strategic direction, coordinated intake and triage, consistent assessment methods and risk language, shared evidence and quality principles, reusable platform and security patterns, stronger risk reporting and traceability, modern workflows and structured data, and progressive use of artificial intelligence (AI) and automation.

This role is broader than traditional assessment delivery. It is an enterprise leadership and transformation opportunity to turn fragmented, document-heavy processes into an integrated, risk-based and evidence-informed assessment lifecycle. It brings together technology risk, cybersecurity, security advisory, third-party risk, cloud and AI security, Governance, Risk and Compliance (GRC) modernization, adoption of ServiceNow Integrated Risk Management (IRM), data and automation, and leadership of a global team.

You will shape and lead six connected themes:

• Integrated Assessment Authority: One accountable leadership model for Threat Risk Assessment (TRA) and Vendor Security Review (VSR), with common direction, methods and risk language across specialized assessment teams.
• Shift-left security assessment: Technology and cybersecurity risks identified and addressed earlier in architecture, design and delivery, when they are least costly to resolve.
• Platform and application assessment: A two-level model that assesses shared platforms once and focuses application and vendor assessments on what is genuinely specific.
• Evidence-informed risk decisions: Risk conclusions grounded in structured, verifiable evidence and consistent rating criteria rather than document volume.
• Modern workflow, data and automation: Assessments run through modern ServiceNow IRM workflows, supported by structured data and the progressive use of AI and automation.
• Portfolio risk insight: Clear, traceable reporting that surfaces recurring and systemic risks across the Bank's technology and third-party portfolio.

The platform and application model works at two levels:

• Horizontal assessments evaluate common platforms, shared services and approved technology patterns once, so related controls and evidence can be reused.
• Vertical assessments evaluate the application, workload, project, vendor or material change, and focus on specific deviations, exposures and residual risks

Is this role right for you? In this role, you will:

• Lead the existing TRA and VSR capabilities under one senior leadership model, preserving specialized expertise while establishing common direction, coordinated intake and triage, and shared standards.
• Define and maintain consistent assessment methodology, risk-rating criteria, quality requirements, evidence principles and finding taxonomies, aligned to the Bank's technology control objectives and enterprise control library and to recognized frameworks such as the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), ISO/IEC 27001 and the Payment Card Industry Data Security Standard (PCI DSS).
• Embed technology and cybersecurity assessment earlier in architecture, design and technology delivery, including the Bank's delivery framework, architecture review processes and Continuous Integration and Continuous Delivery (CI/CD) pipelines.
• Establish reusable security and platform patterns that allow downstream assessments to inherit approved baselines.
• Assess material application-specific and vendor-specific risks, including data, identity, integration, architecture, exposure and residual risk.
• Strengthen threat modelling and scenario-based risk analysis, using recognized approaches such as STRIDE and MITRE ATT&CK.
• Act as the business owner for the technology-risk assessment capability within ServiceNow IRM, defining assessment requirements, workflows and data needs while working with the technical platform team, which owns platform configuration and delivery.
• Lead the assessment-domain transition from legacy processes and repositories into modern IRM workflows, preserving application-to-assessment and application-to-risk traceability and establishing clear data-quality requirements.
• Define risk-based triggers for reassessment following material change, significant vulnerability, control failure or deviation from an approved pattern.
• Establish targeted post-implementation assurance for selected material controls, using authoritative evidence from accountable control owners and specialist functions.
• Prioritize appropriate AI and automation opportunities across intake, triage, context extraction, pattern matching, assessment drafting, evidence orchestration and portfolio insight, in alignment with the Bank's enterprise artificial intelligence and technology-risk automation initiatives.
• Identify recurring and systemic risks across the assessment portfolio and provide clear risk insight to technology leaders and governance forums.
• Produce assessment outcomes that are timely, consistent, traceable, evidence-informed and defensible for regulatory, second-line, quality assurance and Internal Audit review, including under the Office of the Superintendent of Financial Institutions (OSFI) Guideline B-13 and the New York State Department of Financial Services (NYDFS) Part 500 cybersecurity regulation, where applicable.
• Lead and develop a large, multidisciplinary and geographically distributed team, building capabilities in security advisory, cloud and AI security, third-party security risk, methodology, data and automation..

Critical Partnerships:

Success depends on strong partnerships across the Bank's three lines of defense. Each partner keeps its established mandate, and the Senior Director works with them to ensure that assessment conclusions are well-informed and aligned. Key partners include:

• Technology leadership: Chief Information Officers (CIOs) and their delivery, architecture and engineering teams, the primary clients of the assessment capability.
• Cybersecurity and architecture: The Office of the Chief Information Security Officer (CISO) and Enterprise Architecture, to align security standards, patterns and design guidance.
• Control owners and control testing: Teams that implement and operate controls, and the Bank's technology control testing function, whose evidence informs assessment conclusions.
• Technology risk management: Technology risk teams and Risk and Control Self-Assessment (RCSA) teams, which manage and aggregate technology risk across the Bank.
• Platform and automation: The ServiceNow IRM platform and implementation teams, and the Bank's enterprise artificial intelligence and technology-risk automation initiatives, to ensure aligned workflows and data.
• Governance and reporting: IT risk governance, issue management and reporting teams within the Office of the Chief Information Officer.
• Independent oversight: Second-line risk management, Internal Quality Assurance (IQA) and Internal Audit, which provide independent challenge and assurance, and the teams that manage the Bank's regulatory relationships

Do you have the skills that will enable you to succeed in this role? We'd love to work with you if you have:

• University degree in Computer Science, Engineering, Information Security or a related field.
• 10+ years of progressive experience in technology risk, cybersecurity or risk assessment, including senior leadership of technology or cybersecurity risk assessment functions.
• Deep expertise in security advisory, assessment methodology and threat modelling at enterprise scale.
• Strong experience in third-party and vendor security risk, and in cloud, AI, application and platform security.
• A track record of leading enterprise GRC transformation, including with ServiceNow IRM or a comparable GRC platform, from business requirements through adoption.
• Strong understanding of development, security and operations (DevSecOps) practices and secure-by-design principles.
• Experience engaging regulators and Internal Audit in a highly regulated environment, ideally financial services.
• Proven ability to lead large, distributed teams and to lead through influence across federated organizations and with senior technology executives.

Preferred experience

• Advanced degree or professional certifications such as Certified Information Systems Auditor (CISA), Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC) or Certified Information Security Manager (CISM).
• Experience leading platform- and pattern-based assessment models that allow controls to be inherited across applications and workloads.
• Hands-on experience with risk data, evidence orchestration and workflow automation, including integrations with security tooling.
• Familiarity with AI, machine learning and agentic AI applications in GRC, such as intake triage, artifact analysis, control mapping and risk-theme identification.
• Experience applying structured risk-rating criteria, calibration and quantitative risk techniques.
• Experience partnering with control-testing functions to integrate authoritative control evidence into risk assessment, ideally within a large financial institution

What's in it for you?