Senior Information Security Advisor

Scotiabank; Toronto; Hybrid; CAD 80,000 - 120,000; Full time

Job summary

An established industry player is seeking a Senior Information Security Advisor to lead security initiatives in cloud environments. In this pivotal role, you will guide various business lines in implementing security measures that align with industry standards and ensure the protection of information assets. You will work on diverse projects, providing strategic advice and conducting comprehensive security assessments. This role offers an exciting opportunity to engage with cutting-edge technologies and contribute to a culture of innovation and community engagement. Join a forward-thinking organization committed to inclusivity and professional growth!

Benefits

Flexible vacation

Tuition assistance

Competitive rewards program

Community engagement opportunities

Diversity and inclusion initiatives

Workplace accommodations

Qualifications

• 5+ years of experience in security assessments on cloud platforms.
• Strong knowledge of cloud technologies and security frameworks.
• Experience with security solution architecture and cloud environments.

Responsibilities

• Conduct Threat Risk Assessments for cloud initiatives.
• Provide strategic guidance on cloud security solutions.
• Collaborate with teams to design robust security architectures.

Skills

Cloud Security

Risk Management

Application Security

Data Protection

Identity and Access Management

Communication Skills

Problem Solving

Education

Post-secondary education in Computer Science

Tools

GCP

Azure

AWS

Kubernetes

Terraform

CNAPP

CSPM

CWPP

Job description

Title: Senior Information Security Advisor

Requisition ID: 218020

Tangerine is Canada’s leading direct bank. We offer flexible and accessible banking options, innovative products, and award-winning Client service. The reason why Tangerine employees come to work each day is to help Canadians live better lives. We focus on making a difference in our communities, and that includes our own internal community. It’s important to us that our employees feel empowered and enthusiastic about belonging to our Orange culture.

The Team

Scotiabank’s Security Advisory Services team is responsible for providing advisory services to Tangerine Bank and its business lines, subsidiaries and affiliates enabling the achievement of the Bank's Information Security as it continues to move to the Public Cloud.

The Role

Reporting to the Senior Manager of Security Advisory (Tangerine), the Senior Information Security Advisor provides guidance to business lines to ensure design, development and implementation of complex cloud projects and initiatives are in accordance with the Bank's Information Security Standards and in compliance with industry regulations. In this senior role, you will be supporting various business lines while assisting them in making informed decisions to protect information assets deployed in Public Clouds environments.

Is this role right for you? In this role, you will:

1. Have a strong experience leading complex projects providing security advice to ensure information security risks are mitigated.
2. Thrive in solutioning for multiple security domains (Application Security, Data Protection, Cloud Security Engineering, Identity and Access Management, Cloud Security Architecture, Network Security, Risk Management, etc.) and knowledgeable of Zero Trust Architecture principles.
3. Have experience in solutioning security architecture for Public Clouds, creating and reviewing security patterns, and advising on security risks.
4. Be proficient in reviewing architecture and solution design documentation and can identify and assess potential risks.
5. Excel in reviewing Technical Design and Security Design documents and creating assessment documents (Threat Risk Assessment) and evaluating risks.
6. Be passionate about new technologies and enjoy the challenges of implementing security controls to protect them.
7. Work on different types of projects (from large complex to simple).
8. Collaborate with various business lines, IT support functions and IS&C Control functions.

Key Job Accountabilities:

1. Conduct Threat Risk Assessments and perform security advisory work on specific applications and infrastructure associated with Scotiabank’s Cloud and other initiatives ensuring that controls are adequate, meet Bank standards, and enable business objectives.
2. Provide Quality Assurance on Threat Risk Assessments and Threat Modelling as required for Cloud initiatives.
3. Provide strategic guidance and technical expertise on cloud security solutions and recommend best practices.
4. Conduct comprehensive security assessments on large high-profile cloud initiatives implemented in GCP and Azure.
5. Collaborate with cross-functional teams to design and implement robust security architectures for various systems, applications, and networks.
6. Evaluate existing security solutions and propose enhancements or new designs to address emerging threats and business requirements.
7. Ensure alignment with industry best practices, compliance standards, and organizational security policies.
8. Identify security weaknesses, vulnerabilities, and gaps in existing systems and recommend remediation strategies.
9. Provide support on how to apply the Bank's portfolio of standards to the technology footprint of Scotiabank’s Cloud offering.
10. Provide oversight over the specific line of business security posture, ensuring that all tools available to detect and remediate security risks have been applied.
11. Conduct industry reviews and benchmarking exercises to ensure our controls are aligned with our peers, emerging threats, and available mitigation strategies.
12. Work directly with technical leads from assigned Lines of Businesses supporting their initiatives from an Information Security perspective.
13. Provide relationship management function primarily to the Enterprise Cloud team from an Information Security perspective.

Do you have the skills that will enable you to succeed in this role? We'd love to work with you if you have:

1. Post-secondary education in Computer Science or in a related field.
2. At least 5 years of hands-on technical working experience in performing security assessments on cloud platforms, CI/CD deployment pipelines, network infrastructure and complex applications. Experience with Risk Assessments of applications migrated into the Cloud Environments.
3. At least 6 years' experience in security solution architecture, software development, and/or hands-on experience with implementations of cloud environments, security controls and cloud-based solutions.
4. Strong communication skills and capability of creating clear documentation.
5. Solid knowledge of cloud technologies and cloud security (GCP or Azure or AWS, Kubernetes and IAM, CI/CD pipelines, Terraform, infrastructure as code).
6. Experience with GCP and Kubernetes is a strong asset.
7. Experience with tools used in securing cloud deployments such as CNAPP, CSPM, CWPP, etc.
8. Cloud security engineering or cloud solution architecture certifications from Google, Microsoft or AWS.
9. Experience using industry leading productivity tools to produce quantitative/qualitative reports, data flow diagrams & visual presentations.
10. Certifications (CISSP, CISM, CCSP, CRISC) are nice to have.
11. Familiarity with industry standards and frameworks e.g., NIST 800-53, ISO 27001, ISO 27002, ISO 27017, ISO 27018, PCI DSS, CIS.
12. Advanced communication (verbal/written/presentation) skills in English. Knowledge of Spanish is an asset.

What's in it for you?

1. Diversity, Equity, Inclusion & Allyship - We strive to create an inclusive culture where every employee is empowered to reach their fullest potential, respected for who they are, and are embraced through bias-free practices and inclusive values across Scotiabank.
2. Accessibility and Workplace Accommodations - We value the unique skills and experiences each individual brings to the Bank and are committed to creating and maintaining an inclusive and accessible environment for everyone.
3. Upskilling through online courses, cross-functional development opportunities, and tuition assistance.
4. Competitive Rewards program including bonus, flexible vacation, personal, sick days and benefits starting on day one.
5. Community Engagement - We offer opportunities for community engagement & belonging with our various programs such as hackathons, contests, cooking with friends, Humans of Digital and much more!

Working location condition: Hybrid

#LI-Hybrid

At Tangerine, we value the unique skills and experiences each individual brings to the team, and are committed to creating and maintaining an inclusive and accessible environment. If you require accommodation during the recruitment and selection process, please let our Recruitment team know.