Cybersecurity Risk Manager

Softchoice is a software-focused IT solutions and services provider that helps organizations innovate and enhance their technology decisions. The Cybersecurity Risk Manager will identify, assess, and mitigate risks affecting the company's financial health and compliance, while leading the development of a robust cybersecurity risk management program.

Cloud Computing Enterprise Software Information Technology Collaboration

Responsibilities

Take ownership for, mature our Risk Management governance/process, and leverage the broader teams for execution of risk remediation based on priorities and risk appetite

Set strategic direction for cybersecurity risk management, and related compliance initiatives

Develop and maintain a cybersecurity risk framework aligned with ISO 27001

Establish robust governance structures to oversee risk and compliance activities

Guide the organization through compliance audits and engagements with auditors

Oversee risk assessments to define and analyze possible risks, ensuring a comprehensive approach to risk identification

Evaluate the gravity (risk score) of each risk by considering potential organizational impact

Develop, prioritize, and lead the execution of risk treatment plans and control measures

Monitor and ensure evidence-based implementation of controls to achieve compliance

Drive process changes to eliminate or mitigate potential risks

Drive the execution of appropriate technology platform access reviews

Present risk score updates for ISMS committee and recommendations for senior leadership review

Define and implement contingency plans and incident response playbooks to handle cybersecurity crises effectively

Assess existing policies and procedures, identifying gaps and opportunities for improvement as relates to risk management

Recommend and drive the adoption of improved policies to strengthen the organization's cybersecurity posture

Drive initiatives to enhance employees' understanding of cybersecurity risks and best practices

Provide strategic direction, mentorship, and guidance to cross-functional teams involved in cybersecurity risk activities

Lead, motivate, and develop direct and indirect reports to excel in their roles. (future once ICs added under)

Qualification

Cybersecurity governance Risk management ISO 27001 Compliance audits Security operations Project management Analytical skills Research skills Risk assessment Policy development Incident response Employee training Statistical Analysis Software CISSP certification CISM certification CISA certification CRISC certification Professional Risk Manager Leadership Communication skills Problem-solving Team collaboration Technical writing

Required

10-15 years' experience in IT including security operations (SOC)

5 years experience managing people directly and indirectly

At least 5 years working in cybersecurity governance, risk, and compliance (GRC)

Demonstrated knowledge of risk management in the context of cybersecurity, IT compliance, risk assessment, and control

Demonstrated understanding of security practices, trends, and compliance audits

Knowledge of auditing against information security management frameworks (SOC2T2, ISO 27001:2022)

Proven project management approach to drive outcomes is mandatory

Bachelor's or master's degree in computer science, engineering, information security, or a related field

Relevant certifications such as CISSP, CISM, CISA, CRISC

Analytical mind with problem-solving aptitude

Preferred

Experience as a Security Analyst and/or IT Infrastructure work is desirable

Familiarity with industry compliance standards and regulations (e.g., GDPR, Occupational Safety and Health Act)

Strong computer and research skills; knowledge of analysis software preferred (e.g., Statistical Analysis Software, or SAS)

Professional Risk Manager (PRM) certification is a plus

Competitive Benefits: Benefit from competitive perks that start on day one

IT solutions provider for cloud, AI, software, and digital workplaces.

Cybersecurity governance Risk management ISO 27001 Compliance audits Security operations