Partner, Cybersecurity Governance, Risk And Compliance (24 Month Contract)

Don’t miss this opportunity! Submit your application by November 6, 2026 to be considered for this exciting opportunity.

Job Title: Partner, Cybersecurity Governance, Risk and Compliance
Department: IT - Operations
Location: YUL
Reporting Manager: Director, IT Operations, Infrastructure and Security

Reporting to the Director, IT Operations, Infrastructure and Security. The Partner, Cybersecurity Governance, Risk & Compliance will be responsible for establishing and enforcing cybersecurity governance across strategic transformation initiatives (Juniper, CRM, CDP), while designing and implementing a structured cybersecurity framework for Air Canada Vacations aligned with industry standards (NIST or ISO 27002).

This is a 24-month temporary, onsite positionn

WHAT YOU'LL BE DOINGCybersecurity Governance for Strategic Programs

• Establish security governance structures for Juniper (Reservation System), CRM, CDP
• Implement:
  • Security checkpoints and stage gates
  • Risk and compliance reviews within project lifecycle
• Ensure alignment with:
  • Privacy requirements (PIA, data retention, etc.)
  • Architecture and Change Management processes
• Enforce “secure by design” governance across all initiatives

Cybersecurity Framework Development

• Design and implement an enterprise cybersecurity framework for ACV based on NIST Cybersecurity Framework or ISO 27001 / 27002 controls
• Define:
  • Control domains and control catalog
  • Security standards and procedures
  • Governance and accountability model

Policy & Directive Modernization

• Review, rationalize, and modernize Cybersecurity policies, directives and procedures
• Align policies:
  • With Air Canada corporate standards where applicable
  • Reflect modern architectures (cloud, SaaS, APIs)
• Establish clear policy lifecycle and governance model\

Enterprise Asset Management & Data Classification

• Define and implement:
  • Enterprise asset inventory (applications, systems, data)
  • Data classification model (e.G., confidential, regulated, internal)
• Identify:
  • Critical systems and business assets
  • Sensitive and regulated data sets
• Ensure classification drives Access controls, Retention policies, and Security controls

Risk Management & Compliance

• Establish cybersecurity risk management framework:
  • Risk identification and assessment
  • Risk tracking and remediation
• Formalize exception and risk acceptance processes

AI Governance & Responsible Use

• Define and implement AI governance framework including:
  • AI usage policies and directives
  • Risk and compliance controls for AI systems
  • Data usage and model governance standards
• Establish:
  • Approval process for AI use cases
  • Monitoring and audit mechanisms for AI solutions
• Ensure alignment with Air Canada enterprise policies (where applicable)

WHAT YOU BRING TO THE TEAM

• 8–12+ years in Cybersecurity governance / GRC and Risk management / Compliance
• Certifications required (CISSP and / or CISM)
• CRISC, an asset
• ISO 27001 Lead Implementer or Lead Auditor, an asset
• NIST Cybersecurity Framework Training Certification, an asset
• CDMP, an asset
• Proven experience:
  • Implementing NIST or ISO frameworks
  • Supporting large transformation programs
  • Establishing governance models
  • Exposure to AI/data governance initiatives
• Good understanding of:
  • Data governance and classification
  • AI governance concepts (risk, ethics, controls)
  • Cloud and SaaS environments
• Extremely organized and diligent in maintaining consistency
• Autonomous and dedicated
• Excellent communicator
• Results oriented and the ability to manage multiple priorities with a sense of urgency and orientation to deadlines

#J-18808-Ljbffr