Risk Operations and Visibility Manager

University of Toronto; Toronto; On-site; CAD 97,000 - 114,000; Full time

Job summary

The University of Toronto is seeking a Risk Operations and Visibility Manager within the Information Security Governance, Risk and Compliance (GRC) team. You will monitor findings from vulnerability management and attack surface tools to identify and track information security exposures across the University’s environment, consolidating data into a unified risk view for leadership.

You will liaise with distributed IT teams to support timely remediation, develop risk reports, and advocate for the

Qualifications

• University degree in Computer Science, Engineering, Information security, or equivalent combination of education and experience.
• Strong asset: relevant certification (e.g., CompTIA Security+, GIAC GSEC, CRISC).
• Minimum 5 years of progressive information security program experience.
• Knowledge of controls for web apps, cloud, IoT, networks, and servers.
• Experience with vulnerability management lifecycle and CVSS scoring.
• Familiarity with ISO/NIST frameworks and regulatory requirements.

Responsibilities

• Monitor and analyze findings from vulnerability and attack surface management tools.
• Consolidate findings into a unified risk view for leadership.
• Provide clear, actionable reporting and risk narratives for technical and non-technical stakeholders.
• Liaise with distributed IT teams to support remediation of exposures.
• Research and recommend tools for vulnerability management and risk reporting.

Skills

Strategic thinking

Technical reporting

Leadership

Prioritization

Team collaboration

Data analytics

Education

University degree in CS/Engineering/InfoSec

Job description

Description:

The Risk Operations and Visibility Manager position is part of the Information Security Governance Risk and Compliance (GRC) team and will focus on the Risk Operations and Visibility function. This position will be responsible for monitoring and analyzing findings from vulnerability management and attack surface management tools to identify, prioritize, and track information security exposures across the University's environment and consolidating findings from multiple technical sources into a unified risk view of the University's threat landscape.

The incumbent shall possess advance knowledge of IT security tools and technologies amidst a continually evolving threat landscape and to apply such knowledge in evaluating the performance of the operational security risks by producing clear, actionable reporting and risk narratives for technical and non-technical stakeholders, including academic and administrative leadership. They will liaise with distributed IT teams across faculties and divisions to support timely remediation and closure of identified exposures and vulnerabilities while researching, recommending, and supporting the use of software and tools for vulnerability management, attack surface management, and risk reporting to build the internal expertise and function of risk operations and visibility management.

REQUIRED QUALIFICATIONS:

EDUCATION:

• University degree in Computer Science, Engineering, Information security, or equivalent combination of education and experience. A relevant certification (e.g., CompTIA Security+, GIAC GSEC, CRISC, or equivalent) is an strong asset

EXPERIENCE:

• Minimum 5 years of progressive experience in creating, implementing, and maintaining Information Security management programs with a broad range of platforms and technologies
• In-depth knowledge of Information Security controls applicable for web applications, cloud, IoT, mobile applications, networks, and servers
• Minimum 3 years experience performing security assessments of infrastructure (cloud and on-premises), applications and websites
• Minimum 3 years experience working with vulnerability management lifecycle concepts (discovery, scanning, validation, prioritization, remediation tracking) and CVSS/exploitability-based scoring (e.g., EPSS); ability to interpret output from vulnerability scanning tools (e.g., Tenable, Qualys, Rapid7) and attack surface management / cyber security posture management tools (e.g. Falcon, etc.)
• Understanding of Information Security and Risk Management frameworks like ISO27001, ISO27005, NIST CSF and NIST 800-30
• Deep understanding of exposure management and external attack surface management processes
• Experience in grouping individual vulnerabilities and risks for overall reporting purposes
• Experience in threat monitoring and threat intelligence
• Familiarity with legal and regulatory requirements like PCI-DSS, PIPEDA, PHIPA, GDPR etc

SKILLS:

• Able to think strategically about change and new solutions
• Strong writing, communication, presentation and interpersonal skills with the ability to produce high quality, comprehensive communications materials and articulate complex ideas to both technical and non-technical audiences
• Strong leadership and problem-solving skills
• Ability to prioritize and reprioritize work as required
• Adept at conforming to shifting priorities, demands and timelines
• Ability to work both independently and in a team-oriented, collaborative environment
• Proficiency with data analytics and data aggregation; experience with BI/reporting tools (e.g., Power BI, Tableau) and basic scripting (Python, PowerShell) is an asset
• Thirst for knowledge, self-education, and research
• Strong organizational skills in planning and task coordination

OTHER:

Ability to work under pressure of high volume and expectations, while meeting multiple deadlines for multiple projects; strong service orientation coupled with ability to recognize and assess the operational significance of a problem, control/mitigate the risk, and set priorities accordingly. Strong ability to assess risks and controls of computing systems and operations. Demonstrated broad knowledge of information technology, instructional technology, classroom technology, audiovisual technologies, digital signage, network technologies, databases, and application development. Strong ability and willingness to work effectively as a team leader and team member; must be able to collaborate and cooperate with team members, project sponsors, other stakeholders. Ability to lead team members of varying levels and skill sets including Professional/Managerial as well as staff. Must be able to deal calmly and effectively with a variety of people. Demonstrated ability to exercise sound judgment, tact, and diplomacy. Ability to effectively navigate a professional and political climate including assessing the requirement to elevate and issue to more senior levels of management or resources or bodies outside the Faculty; ability to maintain a high level of confidentiality. Ability and willingness to learn new systems, technologies and project management methods and tools.

Closing Date:12/02/2026, 11:59PM ET
Employee Group: Salaried
Personnel Subarea:PM
Appointment Type: Budget - Continuing
Schedule: Full-Time
Pay Scale Group & Hiring Zone:PM 3 -- Hiring Zone: $97,336 - $113,558 -- Broadband Salary Range: $97,336 - $162,224
Job Category: Information Technology (IT)

Diversity Statement

The University of Toronto embraces Diversity and is building aculture of belonging that increases our capacity to effectivelyaddress and serve the interests of our global community. Westrongly encourage applications from Indigenous Peoples,Black and racialized persons, women, persons withdisabilities, and people of diverse sexual and gender identities.We value applicants who have demonstrated a commitment toequity, diversity and inclusion and recognize that diverseperspectives, experiences, and expertise are essential tostrengthening our academic mission.
As part of your application, you will be asked to complete a brief Diversity Survey. This survey is voluntary. Any information directly related to you is confidential and cannot be accessed by search committees or human resources staff. Results will be aggregated for institutional planning purposes. For more information, please see http://uoft.me/UP .

Accessibility Statement

The University strives to be an equitable and inclusive community, and proactively seeks to increase diversity among its community members. Our values regarding equity and diversity are linked with our unwavering commitment to excellence in the pursuit of our academic mission.
The University is committed to the principles of the Accessibility for Ontarians with Disabilities Act (AODA). As such, we strive to make our recruitment, assessment and selection processes as accessible as possible and provide accommodations as required for applicants with disabilities.
If you require any accommodations at any point during the application and hiring process, please contact [e-mail] .

The University of Toronto has implemented a process to substantiate Indigenous Membership/Citizenship/Enrolment for candidates who identify as Indigenous. For more information about this process, please refer to the Indigenous Substantiation Website .