Manager, Cybersecurity & Project Management Office

A vacancy exists in the Information Technology department for the position of Manager, Cybersecurity & Project Management Office.

This role is accountable for the governance of Enova’s cyber security program and the governance of its technology project and program standards. This role owns Enova’s cyber security strategy, policies, standards and roadmap, and is accountable for maintaining compliance with the Ontario Energy Board’s Ontario Cyber Security Framework. This role is accountable for the identification, assessment and treatment of cyber security risk across Enova’s information and operational technology and provides oversight and coordination of security monitoring and incident response. To facilitate successful cyber security implementations during projects this role also owns the frameworks used for medium to large sized technology projects and/or programs from conception to delivery ensuring that security-by-design is embedded in the project portfolio. This role leads a team that includes project planning, tracking and support and system architecture. Managing project budgets, timelines, scope, and resources including business, technical, contract and vendor at the Lead and SME levels is a key part of this role.

Skills/Abilities

• Leadership in cyber security governance, risk management and compliance. Ability to establish, mature and lead a cyber security program as a professional practice within Enova


• Cyber Security Risk Management – ability to identify, assess, prioritize and treat cyber security risks across information and operational technology, and to communicate risk clearly to executive and non-technical audiences


• Working knowledge of security-by-design principles and the ability to integrate security controls and review gates into the project delivery lifecycle without unduly compromising delivery


• Leadership in project management best practices and methodologies. Contribute to establishing project management as a professional practice discipline within Enova. Strong leadership skills to guide and motivate project teams


• Time Management – effective at managing multiple projects and priorities in a fast-paced environment


• Strategic thinking – Ability to align projects with strategic goals


• Ability and willingness to stay up to date with changes in at least one area of technology from both Enova, as well as changes in the technology industry


• Ability and willingness to work under pressure for sustained periods of time on potentially multiple projects


• Risk Management - Ability to identify, assess and mitigate project risks


• Intermediate skills in Microsoft Business Suite (word, excel, etc.)


• Advanced planning, problem solving and analytical skills. Proficient in identifying issues and developing innovative solutions


• Advanced verbal and written communication skills and the ability to communicate effectively with various internal and external stakeholders


• Advanced organization and technical skills to support independent management and timely completion of work plan assignments and priorities


• Customer service orientation with a strong sense of accountability and ownership


• Ability to negotiate and influence the behaviour of stakeholders to achieve desired results; strong negotiation skills to manage conflicts and ensure stakeholder alignment


• Ability to effectively communicate and maintain positive relationships with all types of staff, including technical, professional, vendor and upper management

Education/Knowledge

• University, college degree/diploma or equivalent training or experience


• CISSP, CISM or equivalent cyber security certification, with a willingness to maintain certifications


• Expert knowledge of cyber security governance, risk and compliance practices, and working knowledge of a recognized security control framework (e.g. NIST CSF, ISO 27001, CIS Controls)


• Knowledge of the Ontario Energy Board’s Ontario Cyber Security Framework


• Awareness of operational technology security considerations is an asset


• PMP or equivalent experience with a willingness to maintain these skills


• Expert knowledge of Project Management practices


• Thorough knowledge of various software development lifecycle (SDLC) models


• Influencing and negotiating expert including stakeholder management


• Knowledge of energy sector business, preferably from a business process perspective

Experience

• Progressive experience in a cyber security role, including accountability for security governance, risk assessment, policy development and compliance reporting


• Experience overseeing security operations and incident response, including coordinating internal resources and external service providers during and after security events


• Experience in planning, scheduling and resource balancing for a variety of sizes of projects


• Strong financial acumen with considerable experience in managing the financial aspects of large complex projects


• 5+ years’ related experience of contributing directly to and managing projects


• 3+ years of experience in a supervisory role leading teams in any discipline above

Primary Responsibilities

• Cyber Security Governance: Own and maintain Enova’s cyber security strategy, policies, standards and roadmap, and lead their continuous improvement in line with the evolving threat landscape and Enova’s risk appetite. Act as Enova’s accountable cyber security lead, providing expert advice to senior management and the Enova Project Steering Committee on cyber security posture, risk and investment priorities. Establish and maintain the cyber security governance framework, including the control catalogue, standards and the exception and risk-acceptance process. Build, mature and lead the cyber security function over time, including the design and staffing of the team and the definition of supporting roles.


• Regulatory Compliance: Maintain Enova’s compliance with the Ontario Energy Board’s Ontario Cyber Security Framework and other applicable cyber security regulatory and reporting obligations. Lead periodic self-assessments and maturity evaluations against the framework, own the resulting improvement plan, and prepare and submit the required attestations and reports. Serve as the primary point of contact for cyber security audits, regulatory enquiries and related assurance activities.


• Cyber Security Risk Management: Lead the identification, assessment, prioritization and treatment of cyber security risk across Enova’s information and operational technology. Maintain the cyber security risk register and ensure risks are visible to, and understood by, senior management. Cyber security risk acceptances above a defined threshold – including any decision to proceed to go-live or into production with open security findings – are escalated to the VP of Information Technology for decision rather than accepted within this role, in order to preserve independent oversight of security risk.


• Security Monitoring & Incident Response: Provide oversight and coordination of security monitoring, threat detection and incident response, including the relationship with Enova’s managed security service provider. Own the incident response plan, ensure it is exercised and kept current, and lead the coordination, communication and post-incident review of significant security events, escalating to the VP of Information Technology and other stakeholders as appropriate.


• Security by Design: Ensure cyber security requirements, architecture review and appropriate control gates are embedded within the project management framework and applied consistently across the project portfolio, so that security is addressed from project initiation through to closeout rather than as a late-stage add-on. Provide guidance to project teams, business areas and vendors on secure design and configuration.


• Security Culture & Interim Operations: Establish and maintain a cyber security awareness and training program for all staff, and collaborate with department leaders to promote sound security practices across the organization. Until dedicated cyber security staff are in place, this role will also carry out hands-on security operations activities – such as coordinating vulnerability assessments, reviewing alerts and access, and managing day-to-day security tasks – transitioning these to the future cyber security team as it is established.


• Provision of Expert Advice: Provide expert advice to senior management and stakeholders of IT program and project strategies including best practices. Lead contributor at Project Steering Committee meetings. Plans and directs enterprise-wide projects and/or programs of high complexity. Deliver data driven recommendations to enhance program outcomes and efficiencies. Provides formalized continuing work direction and leadership to assigned team(s) or business resources, developers, business analysts and technical specialists including the scheduling assignment and review of project work. Portions of the work could be completed by third party vendors and the role includes ongoing liaison with and management of the vendors. Effectively resolves project related issues, facilitates/negotiates resolution with key project stakeholders and escalates/communicates issues appropriately. Mentor project leads and junior project managers, and other resources on project management methodologies and best practices.


• Project Management: Negotiates with business partners the overall comprehensive and integrated project management plan for major projects of a complex nature involving multiple business areas or systems crossing multiple services with multiple dependencies. Plans and directs all aspects of the project including Project Charter, Scope, Schedule, Cost, Quality, Staffing, Communication, Risk and Procurement. Negotiates project deliverables, schedules and costing for services from other departments across the entire organization as well as external vendors where applicable. May be involved in leading several projects of varying complexity concurrently. Carry out complex work requirements as generally directed, working largely autonomously to meet needs of teams, projects and timelines.


• Design, implement, and supervise the implementation of new system installations, expansions, modifications and migrations. Prepare project/task schedules for IT projects with the oversight of the VP of IT. Maintain and expedite project/task schedules independently. Review and expedite tasks based on timelines assigned through regular review and collaboration with end users in alignment with the project plan and established priorities.


• Identify and resolve conflicts within project teams and associate work; create contingency plans to mitigate risk. Identify project concerns proactively and alert management of potential risks. Reallocate resources across multiple projects where necessary; identify and resolve any resource allocation discrepancies. Manage project dependencies.

• Administration: Provides comprehensive documentation to track, monitor and communicate project progress against the project management plan, requirements, quality measures, standard processes and milestones.


• Track all project costs to ensure completion within budget. Establish and deliver mechanisms for tracking project progress. Produce regular reports on the progress of projects, deliver these reports to all stakeholders. Closely monitor the efforts and billing of third-party workers, such as consultants, contractors and other specialists. Ensures programs are fully compliant. Oversee program and project budgets and financials, ensuring cost-effective use of resources.

• Technical: Will be involved in the execution of the technically complex aspects of assigned projects. Manage the implementation of various software applications, enhancements, and upgrades that support the business functions. Ensure seamless integration of various IT systems and solutions within the program. Stay updated on emerging technologies and industry trends to inform program strategies.


•  Process: Oversees project budget as well as the budget for discretionary capital expense items and is accountable for ensuring project is delivered within project cost management budget. Acts as the primary liaison/facilitator between the project team and the business sponsor to ensure the business requirements are being met and the current project management plan reflects changes to scope, costs etc.


• Conduct project meetings and forums to solicit feedback, input, and expectations; incorporate these into project plans. Provide communication updates to project team and stakeholders. Conduct project reviews to identify areas for improvement and make recommendations based on findings. Identify, map and optimize program management processes to enhance efficiency and effectiveness. Support change management efforts to ensure a smooth transition during program implementation.


• Safety: Support corporate Occupational Health and Safety initiatives by incorporating safe work practices into daily work routine. Report any unsafe conditions or observed unsafe work practices to Supervisor.