Partner, Cybersecurity Governance, Risk and Compliance (24 Month Contract)

Vacances Air Canada / Air Canada Vacations; Montreal; Presencial; CAD 140.000 - 180.000; Jornada completa

Descripción de la vacante

Vacances Air Canada / Air Canada Vacations is seeking a Partner, Cybersecurity Governance, Risk and Compliance to lead security governance across strategic programs, aligning with NIST or ISO controls and embedding secure-by-design practices into projects.

You will modernize policies, manage data classification and risk, and enable AI governance while reporting to the Director, IT Operations, Infrastructure and Security. This is a 24-month onsite role in Montreal.

Formación

• 8–12+ years in Cybersecurity governance / GRC and Risk management / Compliance.
• Certifications: CISSP and/or CISM; CRISC is a plus.
• Experience implementing NIST or ISO frameworks in large programs.

Responsabilidades

• Establish security governance structures for strategic programs (Juniper, CRM, CDP).
• Design and implement a structured cybersecurity framework aligned with NIST/ISO.
• Modernize cybersecurity policies, directives and procedures.
• Define asset inventory and data classification; enforce access controls.
• Develop risk management and compliance processes; manage exceptions.
• Define AI governance framework including policies and controls.
• Ensure alignment with Air Canada enterprise policies and secure-by-design practices.

Conocimientos

Cybersecurity governance

GRC

Risk management

Compliance

AI governance

Security policies

Security architecture

Educación

CISSP

CISM

CRISC

ISO 27001 Lead Implementer

ISO 27001 Lead Auditor

NIST CSF Training Certification

CDMP

Descripción del empleo

Job Title: Partner, Cybersecurity Governance, Risk and Compliance
Department: IT - Operations
Location: YUL
Reporting Manager: Director, IT Operations, Infrastructure and Security

24-month temporary, onsite positionn.

Reporting to the Director, IT Operations, Infrastructure and Security. The Partner, Cybersecurity Governance, Risk & Compliance will be responsible for establishing and enforcing cybersecurity governance across strategic transformation initiatives (Juniper, CRM, CDP), while designing and implementing a structured cybersecurity framework for Air Canada Vacations aligned with industry standards (NIST or ISO 27002).

This role will modernize cybersecurity policies, define and classify critical information assets, and ensure that cybersecurity is integrated into all projects and business processes from inception.

WHAT YOU'LL BE DOING

Cybersecurity Governance for Strategic Programs

• Establish security governance structures for Juniper (Reservation System), CRM, CDP
• Implement:
  • Security checkpoints and stage gates
  • Risk and compliance reviews within project lifecycle
• Ensure alignment with:
  • Privacy requirements (PIA, data retention, etc.)
  • Architecture and Change Management processes
• Enforce “secure by design” governance across all initiatives

Cybersecurity Framework Development

• Design and implement an enterprise cybersecurity framework for ACV based on NIST Cybersecurity Framework or ISO 27001 / 27002 controls
• Define:
  • Control domains and control catalog
  • Security standards and procedures
  • Governance and accountability model

Policy & Directive Modernization

• Review, rationalize, and modernize Cybersecurity policies, directives and procedures
• Align policies:
  • With Air Canada corporate standards where applicable
  • Reflect modern architectures (cloud, SaaS, APIs)
• Establish clear policy lifecycle and governance model\

Enterprise Asset Management & Data Classification

• Define and implement:
  • Enterprise asset inventory (applications, systems, data)
  • Data classification model (e.g., confidential, regulated, internal)
• Identify:
  • Critical systems and business assets
  • Sensitive and regulated data sets
• Ensure classification drives Access controls, Retention policies, and Security controls

Risk Management & Compliance

• Establish cybersecurity risk management framework:
  • Risk identification and assessment
  • Risk tracking and remediation
• Formalize exception and risk acceptance processes

AI Governance & Responsible Use

• Define and implement AI governance framework including:
  • AI usage policies and directives
  • Risk and compliance controls for AI systems
  • Data usage and model governance standards
• Establish:
  • Approval process for AI use cases
  • Monitoring and audit mechanisms for AI solutions
• Ensure alignment with Air Canada enterprise policies (where applicable)

WHAT YOU BRING TO THE TEAM

• 8–12+ years in Cybersecurity governance / GRC and Risk management / Compliance
• Certifications required (CISSP and / or CISM)
• CRISC, an asset
• ISO 27001 Lead Implementer or Lead Auditor, an asset
• NIST Cybersecurity Framework Training Certification, an asset
• CDMP, an asset
• Proven experience:
  • Implementing NIST or ISO frameworks
  • Supporting large transformation programs
  • Establishing governance models
  • Exposure to AI/data governance initiatives
• Good understanding of:
  • Data governance and classification
  • AI governance concepts (risk, ethics, controls)
  • Cloud and SaaS environments
• Extremely organized and diligent in maintaining consistency
• Autonomous and dedicated
• Excellent communicator
• Results oriented and the ability to manage multiple priorities with a sense of urgency and orientation to deadlines