Careers at CMHC: Bilingual Senior Specialist, IT Security Operations

About the role

Join the Information Technology team, in the Bilingual Senior Specialist, IT Security Operations position. In this role, you will be responsible of implementing and executing the IT Security Operations strategy in line with the objectives of security programs and CMHC’s needs as well as safeguarding the interest of CMHC’s overall security environment.

You will provide oversight and governance for IT Security Operations and continuously evaluate overall effectiveness of the service by tracking and reporting key performance and key risk indicators of the overall service and material components of the service.

This role is accountable for the outcomes and the performance of IT Security Operations, including the performance of service providers or partners, for CMHC. You will ensure that data in IT systems are adequately protected through the effective operations of IT security devices and/or controls.

What you will do:

• Identify and facilitate the implementation of appropriate controls to effectively manage information risks as needed and reference organizationally relevant security frameworks (ISO 27001/2; ITSG-33; NIST).


• Perform oversight and work with service provider to manage day to day IT Security Operations including: maintaining an up-to-date inventory of security controls; providing the requirements for and ensuring the onboarding of new IT projects to security operations; ensuring the scheduling and performance of maintenance activities; evaluating the continued effectiveness of the implemented controls through the establishment and monitoring of key performance or key risk indicators; proposing recommendations for improvement.


• Provide expert level advice to senior management to guide and influence the management of security risks across the corporation, as well as complex consultative advice to relevant stakeholders.


• Review security procedures to ensure compliance with security policy and guidelines and support IT service providers and other relevant 3rd parties in identifying and evaluating the effectiveness of security controls.


• Perform focused information risk assessments of existing or new services and technologies along with business counterparts.


• Develop, gather and track key risk and performance indicators to track overall risk status and the information security program performance, and support the development or evolution of the program.


• Identify opportunities to improve the security risk posture, the security program and in how to proactively mitigate risks or improve security controls at CMHC, whether they are policy related controls, awareness, or other means.


• Stay abreast of industry risk trends and evaluate applicability to the organization and recommend opportunities for improved risk mitigation.

What you should have:

• An undergraduate degree in a related field such as information technology, information security, or information management. The successful completion of an IT security certification is required. A combination of education and/or experience will be considered.


• At least seven (7) years of relevant experience in information security, including work experience in leading complex security operations project.


• Experience and/or knowledge of establishing and implementing a security program roadmap of initiatives.


• Demonstrated experience leading project teams and coaching team members.


• Extensive experience providing strategic advice and recommendations to senior leadership teams and committees.


• Demonstrated experience engaging and influencing internal and external stakeholders.


• Experience managing and tracking budgets as well as building and evolving performance metrics.


• Ability to plan and manage multiple concurrent priorities and work under tight time constraints.


• Bilingual (French, English).

It would be great if you also had:

• Experience managing or working with security operations centers or IT operations is an asset.


• Experience with common and frequent security tools and devices such as firewalls, anti-malware, security incident and event management (SIEM), and vulnerability management is an asset.