Information Security Program Manager

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Information Security Program Manager based in Canada. In this role, you will lead information security programs that protect critical systems, sensitive data, and business operations across multiple client environments. You will combine strategic security leadership with hands-on risk management, regulatory compliance, and security program oversight. Working closely with executive stakeholders, technical teams, and external auditors, you will help organizations strengthen their security posture and meet evolving industry requirements. You will oversee risk assessments, security controls, vulnerability management, and incident response coordination while ensuring alignment with recognized security frameworks. Your expertise will also support business continuity planning, security awareness initiatives, and continuous improvement. This is an opportunity to make a meaningful impact in a client-focused environment serving organizations across regulated industries. Accountabilities - Security program leadership: Develop, implement, and maintain information security programs aligned with business objectives, regulatory obligations, industry standards, and client requirements. - Executive advisory and reporting: Advise senior leadership on security strategy, policies, standards, emerging threats, and potential incidents while communicating program progress, risks, and remediation priorities. - Security policies and controls: Establish and maintain security policies and procedures that safeguard the confidentiality, integrity, and availability of information systems and data.

- Security solutions and operations: Oversee the implementation and effectiveness of security solutions, monitor changes in client environments, and coordinate incident detection, response, and resolution within established service-level agreements. - Risk assessments and vulnerability management: Lead internal, technical, and third-party risk assessments, coordinate vulnerability scanning and penetration testing, and recommend appropriate mitigation strategies. - Regulatory compliance: Guide clients in implementing and maintaining controls aligned with frameworks and regulations such as NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, PCI DSS, and other applicable requirements. - Audit and certification support: Coordinate security audits, assessments, and certification activities by preparing evidence, clarifying control requirements, addressing findings, and tracking remediation progress. - Risk and control management: Evaluate control maturity, identify compliance gaps, prioritize corrective actions, maintain cross-framework control mappings, and document compensating controls and risk acceptance decisions. - Protection of regulated environments: Define security requirements for systems containing sensitive or regulated information, including electronic protected health information (ePHI), payment card data, and controlled unclassified information (CUI). Apply data classification, network segmentation, and other safeguards to manage exposure. - Business continuity and disaster recovery: Develop, maintain, and coordinate testing of disaster recovery and business continuity plans tailored to client systems, facilities, and operational needs. - Security awareness and collaboration: Develop and monitor security awareness training programs, collaborate with cross-functional teams to deliver secure solutions, and participate in client steering committees and working groups. - Client relationship management: Serve as a trusted security advisor, translating complex technical and regulatory requirements into practical recommendations that support business objectives and reduce organizational risk.