Security Lead - saskatoon

Cyber Security Lead - Canada / Remote

Key Responsibilities

• Engage in and act as an extension of the Client IT team led by the Client IT Security Director/CISO
• Provide security thought leadership, consulting and insight into best practices to the Client IT Security team
• Work with Client IT Security on creating, reviewing and updating the Client security roadmap
• Work with Client IT Security to review and analyze business requirements and create appropriate security solutions

Qualifications

• Must work well within a team environment and be results driven to achieve organizational goals
• Minimum of 15 – 20 years of relevant information technology experience:
  • 10 – 12 years of demonstrated experience with IT security risk, defences and security technologies
• Special licenses, other education, certification or professional association memberships:
  • CISSP – Certified Information Systems Security Professional
• Demonstrated experience in the design, development and implementation of security information processes, procedures, controls and solutions
• Demonstrated adaptation to changing business needs and the ability to work in a variety of different business situations
• Education:
  • Minimum Bachelor’s Degree with an emphasis in Computer Science, Information Technology, or Computer Engineering
  • Post‑graduate degree in Computer Science, Information Technology or Computer Engineering, or MBA desirable
• Proven project management skills with experience in a formalised process and the ability to manage multiple projects concurrently
• Working knowledge of the client businesses and functional areas with the ability to understand and assess applicable IT security threats
• Familiarity with applicable legal and regulatory requirements, including, but not limited to
• Strong leadership skills and the ability to work effectively with business managers, IT engineering and IT operations staff
• The ability to interact with client personnel, build strong relationships at all levels and across all business units and organisations, and understand business imperatives
• A strong understanding of the business impact of security tools, technologies and policies
• Excellent verbal, written and interpersonal communication skills, including the ability to communicate effectively with the IT organisation, project and application development teams, management and business personnel; in-depth knowledge and understanding of information risk concepts and principles as a means of relating business needs to security controls; an excellent understanding of information security concepts, protocols, industry best practices and strategies
• Experience working with legal, audit and compliance staff is highly desired
• Track developments and changes in the digital business and threat environments to ensure that these are adequately addressed in security strategy plans and architecture artefacts
• Evaluate statements of work from providers to ensure that adequate security protections are in place. Assess the providers' audit reports (or alternative sources) for security‑related deficiencies and required "user controls," and report any findings to the Director of IT Security
• Experience managing security infrastructure such as firewalls, IPSs, WAFs, endpoint protection, SIEM and log management technology, IAM, PAM & GRC
• Understanding of IT infrastructure:
  • Applications
  • Databases
  • Operating systems (Windows, Unix and Linux)
  • Hypervisors
  • IP networks (WAN, LAN)
  • Storage networks, backup networks and media
  • SSO/MFA – MS Entra ID, 1Password
  • PAM, IGA, UAM, UAR
  • Strong working knowledge of IT service management
    • Change management
    • Configuration management
    • Asset management
    • Incident management
    • Problem management

Solutions Architecture and Design

• (a) Review and respond to customer requests to review platform selection decisions, including providing technical support to develop technical configuration and support policies and procedures
• (b) Review the current security architecture and suggest changes and improvements based on supplier’s experience and industry best practices to the customer for review
• (c) Suggest technology configurations in support of the customer’s strategic business direction and supporting architecture
• (d) Review customer business cases and suggest alternatives as needed
• (e) Participate in proof‑of‑concept projects, including suggesting typical industry best practices
• (f) Participate in updating and developing technology roadmaps associated with deployed services
• (g) Contribute to requirements and statements of work for new technologies and architectures
• (h) Contribute to and participate in quarterly supplier meetings to address product and technology roadmaps
• (i) Contribute to and participate in documenting and developing training materials for presentation to supplier organisations for newly recommended design changes, software feature changes, etc.
• (j) Review test results and provide analysis and input to support design and configuration standards for architectural purposes
• (k) Update documentation, using document management tools that are compatible with the current Microsoft Office Suite, as architectural designs change and decisions are approved

Information Security Management (ISM)

• (a) Where the customer’s information security policy does not presently exist or is lacking, propose current standards based on industry best practices to the customer for review, acknowledgment and approval
• (b) Review and provide initial implementation plans within 30 calendar days after the review is complete
• (c) Implement changes within a timeframe mutually agreed after review and agreement on the implementation plan
• (d) Assist in the development of action plans following data security incidents within the customer’s environments and implementing new controls approved by the customer and within the timeline defined by the customer
• (e) Maintain security documentation related to the customer’s enterprise security architecture and make documentation available online to the customer
• (f) Participate in change management processes to review changes to equipment, software and networks that potentially have security or operational ramifications and modify the change to remove or reduce the security or operational ramifications

Information Security Management System (ISMS)

• (a) Establish processes and access to use the ISMS and security‑related repositories provided by the client in order to use, update and maintain relevant security policies, standards, guidelines and tools to support the client in achieving its information security objectives
• (b) Develop and implement standards, objectives, processes and procedures to maintain compliance within the scope of the services, which support the client’s information security policies
• (c) Update the ISMS in a timely manner based on changes to the technical environment
• (d) Assist the client to audit the ISMS contents to ensure the correctness of the data contained therein