Associate Director, Cyber and Technology Risk (Vancouver)

Job Description

As part of the Group Risk Management team, the Associate Director, Cyber and Technology Risk will support IT/Cyber Risk Management leadership within the Enterprise Resilience Risk team in delivering oversight and challenge processes, including tracking and reporting on the status and quality of key Cyber/Technology Risk programs; developing and utilizing effective risk appetite metrics; identifying policy compliance issues; monitoring incidents; and performing thematic reviews. Responsibilities

Leverage data‑driven insight to provide opinions and challenge on key risk indicators. Support thematic reviews, scenario analysis, external event analysis, recent change initiative assessments, and development of risk profiles for senior management, board, and regulators. Act as second line of defense providing oversight for T&O operational and IT risk programs. Champion risk management and seek solutions. Maintain knowledge of emerging technologies, threats, vulnerabilities and risk‑management practices. Maintain assigned Domain Risk Profiles and a monthly Technology Risk profile. Operate a single front‑door policy to support business requests with follow‑through. Develop and maintain relationships to advise on compliance and incident reporting. Provide oversight and challenge on the management of significant cyber incidents. Support regulatory examinations, requests, assessments and reporting. Recommend changes to Cyber & IT Risk policies/standards to keep pace with emerging technologies and delivery models. Maintain key Technology relationships and manage competing stakeholder relationships. Build relationships within GRM and Operational Risk teams to support common objectives and goals. Qualifications

7 years in financial services or other regulated industries; 5 years of information technology and operations experience, preferably in a security operations center or dedicated security role. Expert knowledge of Cyber Security concepts, methodology, processes and procedures and controls. Experience with enterprise‑grade cyber security tools such as Endpoint Security, Mobile Device Management (MDM), Email Security, Security Incident and Event Management (SIEM), Web Application Firewall (WAF), Intrusion Detection/Prevention (IDS/IPS), Application Security, Vulnerability Management, Data Loss Prevention (DLP). 5 years of experience in risk identification, aggregation, analysis and ranking, with a strong metrics and performance‑management background. Ability to gain credibility and influence in a federated environment and partner with groups across divisions. Very strong interpersonal and communication skills; ability to present to technical specialists, business partners and senior executives. Strong knowledge of IT and operational risk management processes, methods, and tools. Technical knowledge of operating systems (Unix, Windows, z/OS), database systems (Oracle, SQL Server, Sybase, DB2) and middleware (Tomcat, JBoss, IIS). CRISC/CISSP/CISM/CISA or similar certification. Nice‑to‑have: knowledge of IT risk frameworks, NIST, COBIT, SOC2, GRC tools, and project management. Working knowledge of modern technologies such as Cloud, APIs and DevOps. Benefits

A comprehensive Total Rewards Program including bonuses, adaptable benefits, competitive compensation, a world‑class training program and opportunities for progressive responsibilities within a high‑performing team. Job Details

Address: 20 KING ST W, Toronto, Canada Work hours/week: 37.5 Employment type: Full time (Regular), Salaried Platform: GROUP RISK MANAGEMENT

#J-18808-Ljbffr