Information Security Program Manager

Jobgether; Canada; On-site; CAD 105,000 - 120,000; Full time

Benefits offered by this job

Health benefits

RRSP matching

Stock options

Career development

Collaborative workplace

Autonomy

Stability

Meaningful responsibilities

Inclusive workplace

Job summary

Jobgether, on behalf of a partner company, seeks an Information Security Program Manager based in Canada to lead security programs across client environments. You will advise executives, manage risk assessments, and coordinate audits while aligning with frameworks such as NIST CSF, ISO 27001, HIPAA, SOC 2, and PCI DSS.

Responsibilities include policy development, vulnerability management, incident response coordination, and business continuity planning.

Qualifications

• Bachelor's degree in Computer Science, Information Systems, Network Security Engineering, or related discipline (or equivalent).
• Minimum five years in information security leadership (CISO/vCISO or similar).
• At least three years in security operations, engineering, or vulnerability management.
• Experience in consulting or MSS; multi-client regulated industries preferred.
• Hands-on experience implementing controls per NIST/ISO/HIPAA/SOC 2/PCI DSS.
• Audit/assessment experience with external audits and regulatory assessments.
• Knowledge of risk frameworks: NIST RMF, NIST SP 800-30, ISO 27005, ISO 31000, FAIR.
• Experience with regulated data environments and data classification.
• Knowledge of encryption, DLP, secure coding, and related tech.
• CISSP certification is required.
• Additional certifications (CISM/CCSP/CGRC/ISA/HCISPP/CCP) are assets.
• Strong communication and stakeholder management; client-focused.
• Leadership, decision-making, and project management skills.

Responsibilities

• Security program leadership: Develop, implement, and maintain information security programs aligned with objectives and standards.
• Executive advisory: Report to senior leadership on strategy, risks, and remediation priorities.
• Policies and controls: Establish and maintain security policies for confidentiality, integrity, and availability.
• Security solutions and operations: Oversee security tools, SBAs, incident detection, response, and SLAs.
• Risk assessments: Lead internal and third-party risk assessments and remediation planning.
• Regulatory compliance: Guide clients in maintaining controls per frameworks/regulations.
• Audit support: Coordinate audits, prepare evidence, and track findings and closures.
• Risk & control management: Map controls, address gaps, and document risk acceptance decisions.
• Protected environments: Define security requirements for regulated data (ePHI, PCI data, CUI).
• BC/DR: Develop and test business continuity and disaster recovery plans.
• Security awareness: Build training programs and collaborate across teams on secure solutions.
• Client relationship management: Translate complex requirements into practical security recommendations.

Skills

Security program leadership

Stakeholder management

Regulatory compliance

Audit coordination

Risk assessment

Vulnerability management

Incident response

Security frameworks

Data protection

Leadership

Client advisory

Education

Bachelor's degree in CS/IS/NS Engineering

CISSP

CISM

CCSP

CGRC

ISA/HCISPP/CCP

CRISC

CISA

CIPT

Job description

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for an Information Security Program Manager based in Canada.

In this role, you will lead information security programs that protect critical systems, sensitive data, and business operations across multiple client environments. You will combine strategic security leadership with hands‑on risk management, regulatory compliance, and security program oversight. Working closely with executive stakeholders, technical teams, and external auditors, you will help organizations strengthen their security posture and meet evolving industry requirements. You will oversee risk assessments, security controls, vulnerability management, and incident response coordination while ensuring alignment with recognized security frameworks. Your expertise will also support business continuity planning, security awareness initiatives, and continuous improvement. This is an opportunity to make a meaningful impact in a client‑focused environment serving organizations across regulated industries.

Accountabilities

• Security program leadership: Develop, implement, and maintain information security programs aligned with business objectives, regulatory obligations, industry standards, and client requirements.

• Executive advisory and reporting: Advise senior leadership on security strategy, policies, standards, emerging threats, and potential incidents while communicating program progress, risks, and remediation priorities.

• Security policies and controls: Establish and maintain security policies and procedures that safeguard the confidentiality, integrity, and availability of information systems and data.

• Security solutions and operations: Oversee the implementation and effectiveness of security solutions, monitor changes in client environments, and coordinate incident detection, response, and resolution within established service-level agreements.

• Risk assessments and vulnerability management: Lead internal, technical, and third‑party risk assessments, coordinate vulnerability scanning and penetration testing, and recommend appropriate mitigation strategies.

• Regulatory compliance: Guide clients in implementing and maintaining controls aligned with frameworks and regulations such as NIST CSF, ISO/IEC 27001/27002, HIPAA, SOC 2, PCI DSS, and other applicable requirements.

• Audit and certification support: Coordinate security audits, assessments, and certification activities by preparing evidence, clarifying control requirements, addressing findings, and tracking remediation progress.

• Risk and control management: Evaluate control maturity, identify compliance gaps, prioritize corrective actions, maintain cross-framework control mappings, and document compensating controls and risk acceptance decisions.

• Protection of regulated environments: Define security requirements for systems containing sensitive or regulated information, including electronic protected health information (ePHI), payment card data, and controlled unclassified information (CUI). Apply data classification, network segmentation, and other safeguards to manage exposure.

• Business continuity and disaster recovery: Develop, maintain, and coordinate testing of disaster recovery and business continuity plans tailored to client systems, facilities, and operational needs.

• Security awareness and collaboration: Develop and monitor security awareness training programs, collaborate with cross-functional teams to deliver secure solutions, and participate in client steering committees and working groups.

• Client relationship management: Serve as a trusted security advisor, translating complex technical and regulatory requirements into practical recommendations that support business objectives and reduce organizational risk.

Requirements

• Education: A bachelor's degree in Computer Science, Information Systems, Network Security Engineering, or a related discipline, or equivalent professional experience.

• Information security leadership: At least five years of information security leadership experience, such as Chief Information Security Officer (CISO), virtual CISO (vCISO), or another senior security leadership position.

• Technical security experience: At least three years of experience in security operations, security engineering, vulnerability management, system administration, or a related technical discipline.

• Consulting and client management: Experience in consulting or managed security services, preferably supporting multiple clients across regulated industries such as healthcare, financial services, or government contracting.

• Compliance and control implementation: At least three years of hands‑on experience implementing and operating security controls aligned with frameworks such as NIST, ISO/IEC 27001, HIPAA, SOC 2, or PCI DSS.

• Audit and assessment experience: Demonstrated experience acting as a security point of contact during external audits, regulatory assessments, and certification processes.

• Risk management expertise: Working knowledge of risk assessment and management methodologies, including NIST Risk Management Framework (RMF), NIST SP 800-30, ISO/IEC 27005, ISO 31000, and FAIR, with the ability to apply them to risk treatment, prioritization, and reporting.

• Regulated data environments: Experience defining the scope of regulated systems, identifying applicable controls, and reducing compliance scope through data classification and network segmentation.

• Data protection technologies: Knowledge of encryption, tokenization, data loss prevention, secure coding practices, and other technologies used to protect sensitive information.

• Required certification: Certified Information Systems Security Professional (CISSP).

• Preferred certifications: Certified Information Security Manager (CISM), Certified Cloud Security Professional (CCSP), Certified in Governance, Risk and Compliance (CGRC), or framework‑specific credentials such as PCI Internal Security Assessor (ISA), HealthCare Information Security and Privacy Practitioner (HCISPP), or CMMC Certified Professional (CCP).

• Additional certifications considered an asset: Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), or Certified Information Privacy Technologist (CIPT).

• Communication and stakeholder management: Excellent written and verbal communication skills, with the ability to explain complex security and compliance requirements to both technical and non‑technical audiences.

• Leadership and decision‑making: Strong judgment, project management, organizational, and problem‑solving skills, with the ability to prioritize competing demands and drive security initiatives to completion.

• Client‑focused approach: Strong interpersonal skills, relationship management capabilities, attention to detail, and the ability to collaborate effectively across teams while maintaining a high standard of accountability.

Benefits

• Competitive annual salary: CAD $105,000–$120,000, with potential eligibility for bonus or merit‑based compensation.

• Comprehensive benefits package: Access to health benefits designed to support employee well‑being.

• Retirement savings: Registered Retirement Savings Plan (RRSP) matching to help support long‑term financial goals.

• Stock options: Opportunities to participate in a stock option program, subject to applicable eligibility and plan terms.

• Career development: Opportunities to build expertise, expand professional skills, and advance your career.

• Collaborative workplace: A supportive, team‑oriented environment that encourages knowledge sharing and cross‑functional collaboration.

• Professional autonomy: Opportunities to take ownership of security initiatives, contribute strategic insights, and make a tangible impact.

• Long‑term stability: The opportunity to work within an established organization with a financially stable business structure.

• Meaningful responsibilities: Exposure to diverse client environments, complex security challenges, and a broad range of regulatory frameworks.

• Inclusive workplace: A commitment to equitable employment opportunities and reasonable accommodations throughout the recruitment process.