Information Risk Security Advisor

COFOMO; Montreal; Hybride; CAD 90 000 - 130 000; Plein temps

Résumé du poste

COFOMO, a leading Canadian consulting firm in Montreal, seeks an Information Risk Security Advisor to strengthen our information security program. You will implement ISMS, guide standards, and coordinate audit prep, with emphasis on governance and risk mitigation.

Ideal candidates bring about 7 years in IT security, DevSecOps experience, and familiarity with AWS/Azure security, ISO 27001, and penetration testing.

Qualifications

• 7+ years of experience in IT security, with governance and information risk management.
• Experience in vulnerability management and governance plans.
• Proficient in DevSecOps and working with DevOps teams.
• Familiar with securing CI/CD pipelines in AWS or Azure; AWS/Azure knowledge.

Responsabilités

• Develop and evolve the Information Security Management System (ISMS) directives, guides, standards, and processes.
• Support PCI, WLA and ISO audit preparation and required compliance activities.
• Assess risks, propose mitigation, and monitor information resource risk annually.
• Ensure security requirements in third-party agreements and vendor risk management.
• Secure CI/CD pipelines and integrate security into DevOps environments.

Connaissances

Information security governance

Information risk management

Vulnerability management

DevSecOps

CI/CD security

AWS security

Azure security

ISO 27001

Penetration testing

DevOps collaboration

Description du poste

# Information Risk Security AdvisorMontrealHybridCybersecurity and Identity ManagementApplyWith over 30 years of recognized expertise, COFOMO is now a leading Canadian consulting firm specializing in digital and artificial intelligence. Supported by more than 3,000 experts, 10 Centers of Excellence, and 4 offices across the country, we are uniquely positioned to successfully guide our clients through their transformations. Both strategic and tactical, we help organizations across a wide range of industries thrive in today’s rapidly evolving world.## Our promiseHelp our clients succeed and maximize the impact of their transformation initiatives, turning them into powerful drivers of growth and innovation.## Job description**Here's a brief overview of the tasks and responsibilities you'll be able to do:** * Develop and evolve the Information Security Management System (ISMS), including directives, guides, standards, principles, methodologies and processes of the normative framework;* Support PCI, WLA and ISO audit preparation and required compliance activities;* To make recommendations for the evolution of information security architecture and practices;* Update the organization's information risk profile annually;* Continuously assess the risks associated with information resources and information systems, and recommend measures to keep the risks at an acceptable level;* Analyze strategic directions, architecture concepts and business needs to establish security positioning and recommendations;* Develop information risk analyses and mitigation measures as part of IT development projects and compliance activities;* Develop and evolve security risk management processes related to critical third parties and vendors;* Ensure the application and monitoring of security requirements associated with third-party agreements;* Contribute to the spot check of the security posture of critical vendors;* To act as a consultant on vendor-related information security issues;* Conduct strategic monitoring of trends, risks and threats in the field of information security, particularly in the field of gambling;* Perform risk analyses following high-profile security breaches and propose recommendations adapted to the organization's context;* Secure CI/CD pipelines and help integrate security practices into DevOps environments. **The profile you are looking for is as follows:** * Have approximately 7 years of experience in IT security, including significant experience in governance and information risk management;* Have a minimum of 5 years of experience in the fields related to the mandate;* Experience in vulnerability management and in developing governance plans;* Be proficient in DevSecOps practices and have experience working with DevOps teams;* Be familiar with securing CI/CD pipelines in an AWS environment or have significant experience with Azure combined with knowledge of AWS;* Demonstrate experience with ISO 27001;* Have completed information security awareness plans;* Experience in penetration testing and vulnerability management (an asset).