Director, Information Security

Reporting to the Vice President, Compliance, the incumbent is responsible for ensuring that the confidentiality, integrity and availability of information and systems at IFDS are in line with policy, regulatory requirements and business needs. The Director, Information Security will be responsible for ensuring the continued delivery of the overall information security program as well as driving improvement initiatives in processes and controls and program enhancements. This is a leadership role focused on governance and communication with internal & external stakeholders, the ability to negotiate and influence technology and business stakeholders. The Director will be required to collaborate closely with technology and product engineering teams regarding information security matters.

Policies & Governance: Ongoing policy compliance oversight. Annual review and enhancement of policy content. Development of new policies and standards, as required.
Vulnerability Management: Work with the service provider in reviewing & tracking results from vulnerability scanning and Penetration testing.
Change Governance: Participation in the CAB and change approval processes. Security advisory and governance for major projects.
Logical Access Governance: Facilitating audit recertification processes pertaining to logical and physical access including privileged and remote access.
Security Monitoring: Oversight of service provider’s SOC generated alerts that require participation of IFDS Information Security.
Security Incident Management: Delivery of commitments as laid out in the IFDS incident response plan including assisting with containment and reporting.
Supplier Risk Management: Due diligence reviews for ongoing material services providers. Assessing new software and services prior to acquisition.
Client Due Diligence: Overseeing and contributing to responses for Client DDQs (due diligence questionnaires). Facing off to onsite client driven security discussions and audits.
Audit & Compliance: Facing off to internal and external auditors. Staying abreast of relevant changes and requirements in the regulatory landscape such as PIPEDA and GDPR.
ISO 27001 Certification: Maintaining compliance with the requirements of the standard. Overseeing ISO 27001 audit and recertification process.
Committees: Chairman and membership of information security related committees and recurring meetings.
Risk Reporting: Preparation of a quarterly scorecard. Presentation of security metrics and risk assessments to IFDS Canada executive leadership and stakeholders within broader organizational structure.
Process improvement: Identifying opportunities to streamline processes, increase efficiency and enhance internal/external client experience.

Responsibilities

Security Advisory (Threat Intelligence & information resources):

Monitoring subscription feeds and the public domain to stay abreast of security developments and the external threat landscape. Disseminating this information internally as appropriate
Manages SOC oversight including SIEM and other supporting technical components
Access Governance of technical controls to secure access in respect of future cloud based initiatives

Security Compliance & Risk:

Participation in third party assurance audits and responding to client security due diligence audits and surveys.
Conduct risk assessments, report results, and provide recommendations for mitigating actions. Implement these where applicable.

Security Governance:

Promoting awareness and understanding of security & privacy issues within IFDS and committees

People Management

Provides leadership to direct reports and their staff to build a team environment where excellence is the goal of everyone by:

Models the values and the goals of the organization and the management team.
Provides day-to-day coaching relative to the development of both technical and behavioral competencies. Ensuring all associates receive coaching and developmental support.
Ensures key resources are identified and plans for retention are in place.
Promotes appropriate training and development.
Assuring compliance with Company Human Resources management/policies

Minimum Qualifications:

CISSP (Certified Information Systems Security Professional) and CCFP (Certified Cyber Forensics Professional)
Minimum 7+ years Data Security or Information Security related experience
Familiarity with the ISO 27001:2013 standards, OSFI and NIST cyber security benchmarking
Excellent interpersonal and communication skills, must have the ability to present highly technical and complex information into “simple English” that is consumable by clients (both internal and external) and IFDS senior management
Demonstrated proficiency in communicating complex information with internal stakeholders or clients
Able to handle or lead (as appropriate) complex projects major changes
Strong interpersonal/negotiation skills and ability to influence others
Able to present/discuss solutions at a high level to potential clients
Highly analytical with a very high degree of attention to detail
Strong research / information gathering / analytical and problem-solving skills - takes a logical approach to analyzing problems. Systematically researches information and explores alternatives to solve problems

Beneficial:
Additional certifications in one or more of the following:

ISACA CISM
ISACA CISA
ISC2 SCCP

AODA Statement
IFDS Canada encourages applications from all qualified individuals. Applicants with disabilities may notify us of any accommodation needed to support your participation in the recruitment process. We wish to thank all applicants for their interest and effort in applying. Please be aware that only candidates selected for interviews will be contacted for this position.

IFDS Group

New Jobs

Director - Information Security