As the Manager, Information Security Risk, you will lead the assessment, governance, and oversight of information security risks across enterprise technology initiatives, with a primary focus on the secure adoption and enablement of Artificial Intelligence (AI) solutions.
This role is accountable for leading Threat Risk Assessments, AI security reviews, vendor and solution risk assessments, and architecture risk reviews to ensure technology initiatives are designed and implemented in alignment with the organization's security standards, privacy obligations, regulatory requirements, and risk appetite.
You will serve as a key Information Security advisor to business leaders, technology teams, Legal, Privacy, Compliance, Enterprise Architecture, and project delivery teams. The role will help establish practical guardrails, control expectations, and governance processes that enable responsible AI adoption while protecting the organization’s data, systems, customers, employees, and business operations.
Working closely with the Director, Information Security & IT Risk, this role will support the continued maturation of the organization's information security risk management program, including AI security governance, emerging technology risk assessment, regulatory alignment, security policy development, and enterprise risk reporting.
Responsibilities:
- Lead Threat Risk Assessments for enterprise technology initiatives, including AI, Generative AI, machine learning, cloud, SaaS, and third-party technology solutions.
- Serve as the Information Security lead for AI-related initiatives, assessing risks related to data exposure, prompt injection, model misuse, third-party AI providers, data residency, retention, intellectual property, and regulatory obligations.
- Develop and maintain AI security standards, assessment methodologies, risk review processes, and practical guardrails to support responsible AI adoption across the organization.
- Review solution architectures, data flows, access models, and integration patterns to identify security risks and recommend appropriate control requirements.
- Partner with Legal, Privacy, Compliance, Enterprise Architecture, Procurement, Technology, and business stakeholders to assess and manage information security risks throughout the solution lifecycle.
- Track security findings and risk treatment activities through remediation, ensuring clear ownership, risk acceptance, escalation, and reporting where required.
- Monitor emerging AI, cyber, regulatory, and technology risk trends and provide recommendations to strengthen the organization’s security governance, policies, and control environment.
Requirements:
- Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, Risk Management, or a related field, with 7+ years of experience in information security, technology risk, security architecture, governance, or a related discipline.
- Strong experience leading Threat Risk Assessments, security reviews, vendor risk assessments, solution risk assessments, or architecture reviews for enterprise technology initiatives.
- Solid understanding of information security controls across identity and access management, cloud security, data protection, logging and monitoring, secure architecture, third-party risk, and incident response.
- Experience assessing risks related to AI, Generative AI, Microsoft Copilot, ChatGPT Enterprise, Azure OpenAI, machine learning platforms, automation, or AI-enabled SaaS solutions is strongly preferred.
- Knowledge of security, privacy, and risk frameworks such as ISO 27001, NIST, SOC 2, PCI DSS, OWASP, NIST AI RMF, ISO/IEC 42001, and applicable Canadian privacy and regulatory expectations.
- Strong ability to translate technical and security risks into clear business risk statements, practical recommendations, and executive-level summaries.
- Demonstrated ability to influence stakeholders, challenge assumptions constructively, and enable business outcomes while maintaining appropriate security and governance standards.
- Relevant certifications such as CISSP, CISM, CRISC, CCSP, ISO 27001, or AI/security-related certifications are considered an asset.
$124,500 - $152,300 CAD