The IT Security Manager reports into the Director, Corporate IT Services.

This position is a hands-on operational role for IT Security and Compliance programs and plays a key role in ongoing efforts to mitigate Rocky Mountaineer’s exposure to current and future cyber risks. This individual will be responsible for ensuring information systems are configured and maintained in a fashion consistent with the prescribed policies, procedures, and standards. This includes collaborating with the Manager, Compliance & Privacy to enforce standards such as PCI DSS, and ISO 27001 and investigating potential deviations from stated positions.

The key responsibility of this position pertains to maintaining and ensuring organizational compliance with established security standards with respect to various lines of business including: outsourced initiatives; ecommerce and sales applications; call centers; Marketing systems; etc. This also includes conducting security audits at the direction of management including vulnerability scans, penetration tests, process audits, social engineering audits, etc. A large portion of the responsibilities of this role involves the discovery, evaluation of sufficiency and maintenance of evidence required to demonstrate compliance with industry regulation and legislation.

Key Areas of Accountability

IT Security Plan Design and Execution:

Lead the design, implementation, and maintenance of the organization’s cyber-security program.
Maintain and execute strategic plans pertaining to information security while ensuring objectives align with those of the company.
Conduct threat-risk analysis on various processes, technology deployments, and 3rd parties.
Provide oversight and hands-on management of the security of information assets.
Evaluate and audit deployed technology and physical security of various environments (including threat management, spam filtering and proactive AI technologies preventing attacks).
Manage projects addressing information security and participate in cross departmental projects ensuring security objectives are considered.
Investigate process inefficiencies or technology problems affecting security or privacy objectives.
Investigate credit card processing, technical or procedural issues, and ensure revenue recovery.
Work with the Compliance team to ensure Rocky Mountaineer’s credit card processing channels are operating in line with PCI requirements: Point of Sale terminals; eCommerce infrastructure; paper-based processes.
Identify and manage deficiency remediation of non-compliant credit card processing channels.
Monitor events captured through a SIEM and escalate notification and remediation as required.
Identify and raise operational issues as necessary.

Internal/External Partnerships:

Negotiate and manage vendor contracts as necessary.
Work with third-party auditors and assessors.
Work with technical staff to ensure technical variances in security initiatives are addressed appropriately as needed.
Collaborate with the Compliance and Enterprise Risk Management teams as required.
Participate or lead information security event and incidents responses including appropriate executive and external reporting.

Training, Documentation and Best Practice Initiatives:

Create, maintain, and deliver information security awareness training material, incident response training and other security training for all team members.
Create PCI DSS awareness collateral and communicate training to all stakeholders including staff, contractors, clients, vendors and partners.
Maintain and update information security stance and principles, policy, and standards documents.
Review detailed design documents pertaining to architectural changes and technology adoption.
Participate in updating procedures controlled by other departments pertaining to maintaining the security of Rocky Mountaineer’s systems.
Ensures a change management program is implemented and fosters a culture of security and compliance.
Develop and direct implementation of security standards and best practices for the organization.
Conduct or manage vulnerability scans and internal penetration tests as needed.
Collect and maintain technical evidence for compliance initiatives.

Qualifications

Education / Certifications / Knowledge

The ideal candidate will have a bachelor’s degree in engineering or computer science or in another relevant field.
The ideal candidate should hold at least one security industry certification, such as CISSP, CISA, CISM or SANS GIAC or demonstrate a willingness to pursue such a credential.
The ideal candidate should have a technical background with technical certifications an asset (Cisco, VMware, Citrix, Microsoft).
Project Management and Change Management experience / certification an asset.

Experience

7+ years of experience as a technologist (system administration) with a developing focus on information security and business analysis.
3 or more years in an Information Security Management role.
Experience with information security concepts and controls (both technical and conceptual).
Experience interpreting and actioning data from a security information and event management (SIEM) platform.
Broad exposure to PCI DSS with at least 1 year experience working in environments subject to compliance (Level 1 merchant experience a plus).
Working knowledge of data security and cybersecurity frameworks such as NIST and ISO 27001.
Experience managing, monitoring, interpreting, and actioning the results of vulnerability scanning platforms (Nessus, OpenVAS, Netsparker)
Broad understanding of networking technology, server infrastructure, various communication protocols, operating systems, hardware platforms, data centre operations, telecommunications, virtualization, storage technologies, remote user management, MPLS, Databases, Microsoft 365, Azure, and AWS Cloud Services, VOIP telephony.
Experience with data, network and internet security technologies and products including firewalls, routers, network intrusion prevention, host-based intrusion detection devices, file integrity monitoring systems, vulnerability testing, web application layer firewalls, encryption key management, security information and event management systems.

Skills 

Results-oriented and customer-focused. Demonstrated ability to develop effective working relationships with internal and external customers.
Ability to assess and interpret risks.
Acts with integrity and transparency.
Developed people and relationship building skills.
Ability to drive and manage change.
Comfortable and effective in eliminating barriers and working across organizational, functional boundaries to achieve corporate objectives.
Strong project management skills.
Strong ability to manage multiple conflicting priorities, reprioritize tasks, establish priorities, work independently, and meet deadlines.
Demonstrated ability to probe, analyze and problem-solve complex issues.
Decision maker & independent worker.
Strong interpersonal skills and the ability to adapt in a complex and changing environment.
Work with detailed technical information and hands-on technology experience.
Manage personal stress and know own limits.
Ability to maintain information in confidence and exercise good judgment.
Strong written and oral communication skills.

Covid - 19 Vaccination Policy:

Rocky Mountaineer (RM) is committed to the safety and health of our team members through providing a safe working environment. As a federally regulated transportation organization, we have a duty to comply with all applicable legislative requirements.

Therefore, all individuals who will start working with RM on November 12, 2021, onwards, will be required to present proof of vaccination confirming they are fully vaccinated against COVID-19 prior to beginning their employment. An individual is fully vaccinated 14 days after receiving their second dose of a two-dose COVID-19 vaccine series or their first dose of a one-dose approved vaccine by Health Canada. Offers of employment to start work with RM on or after November 12, 2021, will be conditional upon receipt of proof of the job candidate being fully vaccinated against COVID-19.

Note: Reasonable accommodations will be considered if they comply with the medical or religious exemptions permitted by applicable federal legislation and ministerial orders.

Rocky Mountaineer

New Jobs

IT Security Manager