Information Security Program Manager

Accountabilities: Security program leadership: Develop, implement, and maintain information security programs aligned with business objectives, regulatory obligations, industry standards, and client requirements. Executive advisory and reporting: Advise senior leadership on security strategy, policies, standards, emerging threats, and potential incidents while communicating program progress, risks, and remediation priorities. Security policies and controls: Establish and maintain security policies and procedures that safeguard the confidentiality, integrity, and availability of information systems and data. Security solutions and operations: Oversee the implementation and effectiveness of security solutions, monitor changes in client environments, and coordinate incident detection, response, and resolution within established service-level agreements. Risk assessments and vulnerability management: Lead internal, technical, and third-party risk assessments, coordinate vulnerability scanning and penetration testing, and recommend appropriate mitigation strategies. Regulatory compliance: Guide clients in implementing and maintaining controls aligned with frameworks and regulations such as NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, PCI DSS, and other applicable requirements. Audit and certification support: Coordinate security audits, assessments, and certification activities by preparing evidence, clarifying control requirements, addressing findings, and tracking remediation progress. Risk and control management: Evaluate control maturity, identify compliance gaps, prioritize corrective actions, maintain cross-framework control mappings, and document compensating controls and risk acceptance decisions. Protection of regulated environments: Define security requirements for systems containing sensitive or regulated information, including electronic protected health information (ePHI), payment card data, and controlled unclassified information (CUI). Apply data classification, network segmentation, and other safeguards to manage exposure. Business continuity and disaster recovery: Develop, maintain, and coordinate testing of disaster recovery and business continuity plans tailored to client systems, facilities, and operational needs. Security awareness and collaboration: Develop and monitor security awareness training programs, collaborate with cross-functional teams to deliver secure solutions, and participate in client steering committees and working groups. Client relationship management: Serve as a trusted security advisor, translating complex technical and regulatory requirements into practical recommendations that support business objectives and reduce organizational risk. Requirements Education: A bachelor's degree in Computer Science, Information Systems, Network Security Engineering, or a related discipline, or equivalent professional experience. Information security leadership: At least five years of information security leadership experience, such as Chief Information Security Officer (CISO), virtual CISO (vCISO), or another senior security leadership position. Technical security experience: At least three years of experience in security operations, security engineering, vulnerability management, system administration, or a related technical discipline. Consulting and client management: Experience in consulting or managed security services, preferably supporting multiple clients across regulated industries such as healthcare, financial services, or government contracting. Compliance and control implementation: At least three years of hands-on experience implementing and operating security controls aligned with frameworks such as NIST, ISO/IEC 27001, HIPAA, SOC 2, or PCI DSS. Audit and assessment experience: Demonstrated experience acting as a security point of contact during external audits, regulatory assessments, and certification processes. Risk management expertise: Working knowledge of risk assessment and management methodologies, including NIST Risk Management Framework (RMF), NIST SP 800-30, ISO/IEC 27005, ISO 31000, and FAIR, with the ability to apply them to risk treatment, prioritization, and reporting. Regulated data environments: Experience defining the scope of regulated systems, identifying applicable controls, and reducing compliance scope through data classification and network segmentation. Data protection technologies: Knowledge of encryption, tokenization, data loss prevention, secure coding practices, and other technologies used to protect sensitive information. Required certification: Certified Information Systems Security Professional (CISSP). Preferred certifications: Certified Information Security Manager (CISM), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC), or framework-specific credentials such as PCI Internal Security Assessor (ISA), HealthCare Information Security and Privacy Practitioner (HCISPP), or CMMC Certified Professional (CCP). Additional certifications considered an asset: Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or Certified Information Privacy Technologist (CIPT). Communication and stakeholder management: Excellent written and verbal communication skills, with the ability to explain complex security and compliance requirements to both technical and non-technical audiences. Leadership and decision-making: Strong judgment, project management, organizational, and problem-solving skills, with the ability to prioritize competing demands and drive security initiatives to completion. Client-focused approach: Strong interpersonal skills, relationship management capabilities, attention to detail, and the ability to collaborate effectively across teams while maintaining a high standard of accountability. Benefits Competitive annual salary: CAD $105,000–$120,000, with potential eligibility for bonus or merit-based compensation. Comprehensive benefits package: Access to health benefits designed to support employee well-being. Retirement savings: Registered Retirement Savings Plan (RRSP) matching to help support long-term financial goals. Stock options: Opportunities to participate in a stock option program, subject to applicable eligibility and plan terms. Career development: Opportunities to build expertise, expand professional skills, and advance your career. Collaborative workplace: A supportive, team-oriented environment that encourages knowledge sharing and cross-functional collaboration. Professional autonomy: Opportunities to take ownership of security initiatives, contribute strategic insights, and make a tangible impact. Long-term stability: The opportunity to work within an established organization with a financially stable business structure. Meaningful responsibilities: Exposure to diverse client environments, complex security challenges, and a broad range of regulatory frameworks. Inclusive workplace: A commitment to equitable employment opportunities and reasonable accommodations throughout the recruitment process.