Senior Manager, Cybersecurity Governance and Risk Management

LCBO (Liquor Control Board of Ontario); Toronto; On-site; CAD 96,000 - 179,000; Full time

Benefits offered by this job

Health / Dental Benefits

Employee & Family Assistance Program

Defined Benefit Pension

Discounts on products and services via

Job summary

LCBO (Liquor Control Board of Ontario) is seeking a Senior Manager, Governance & Risk Management to oversee the information security program, governance, and risk activities from onsite in Toronto. You will lead a team, drive policies, and manage third-party security services while reporting to the Director, Cybersecurity and the Core executive team.

The role requires strong cybersecurity experience, leadership skills, and knowledge of frameworks like NIST RMF/CSF, COBIT, and ISO 27001.

Qualifications

• 5+ years in cybersecurity or IT risk management.
• Experience conducting security reviews and risk assessments.
• Knowledge of NIST RMF/CSF, COBIT, ISO 27001, CIS.
• Cloud environments such as Azure, AWS, and Google.
• Experience with PCI-DSS compliance.
• Professional certifications CRISC/CISA/CISM/CISSP.

Responsibilities

• Develop an IT Risk and Security Management Framework.
• Lead the Governance & Risk Management team daily activities.
• Oversee Third-Party Risk Management program across LCBO.
• Lead enterprise security training and awareness programs.
• Report risk posture to Executive Core team and Board-level
• Manage security governance documents and third-party assessments.

Skills

Cybersecurity governance

Risk management

Threat risk assessments

Team leadership

Vendor management

Policy development

Executive communication

Education

CRISC certification

CISA certification

CISM certification

CISSP certification

Bachelor's degree in IT or related field

Tools

GRC platforms

Job description

Location Address: 100 Queens Quay East, 9th Floor, Toronto Number of Openings: 1 Pay: $96,244.00 - $178,668.00 Job Posting Description: Senior Manager, Governance & Risk Management This is an onsite role [#LI-Onsite] Are you passionate about overseeing cyber risk management and developing a team of cybersecurity professionals? Reporting to the Director, Cybersecurity, you will develop and operate the LCBO's information security program and manage cybersecurity governance and risk activities. The senior manager ensures our cybersecurity policies, standards, and procedures are in place and followed while implementing risk assessments and providing oversight and challenge to third-party security service providers. You will also partner with the security architecture practice and lead the development and management of the security training and awareness program while also supporting the reporting function to the Core executive team and Board-level communications. Finally, you will conduct security risk assessments as they relate to all projects that are funneled through the IT Division, including supporting RFP responses. If you have strong cybersecurity experience and enjoy leading a team, then this is the role for you!

About the Role

• Develop an IT Risk and Security Management Framework
• Be a trusted advisor across all LCBO divisions to identify data and technology-based risks, giving partners expert and realistic analysis to inform their decision‑making process.
• Conduct regular threat risk assessments (TRA) to identify cybersecurity risks and recommend mitigation strategies.
• Maintain the TRA process and associated artefacts.
• Evaluate the adequacy of the security controls for our information and technology systems.
• Manage the LCBO-wide information security compliance program, ensuring IT activities and procedures meet defined requirements.
• Develop cybersecurity governance documents (policies, standards, baselines, and guidelines) in compliance with relevant legislation and best practices.
• Conduct cybersecurity assessments of third‑party vendors and partners to ensure adherence to LCBO's cybersecurity policies.
• Lead the Third‑Party Risk Management program, assign resources to facilitate TPRM across LCBO, and promote awareness and a culture of risk management across the enterprise.
• Continuously improve risk management practices and organizational readiness to respond to evolving cyber threats.
• Oversee enterprise‑wide tabletop exercises, identify gaps, and track the associated lessons learned and next steps.
• Manage the executive security risk dashboard, highlighting material risks, trends, and required actions.
• Report and communicate with Executive Core team regarding our risk posture.
• Provide oversight of Managed Security Service Provider services supporting GRC and TPRM and develop metrics to ensure adequate service delivery.

Risk Assessment and Control Assurance

• Recommend cybersecurity improvements and identify risk and control requirements for upgrades and/or new technologies to enhance the security posture.
• Provide practical, risk‑based recommendations to address cybersecurity problems in a cost‑effective manner.
• Provide security risk and control guidance in support of new technology deployments and projects to improve overall enterprise security.
• Participate in security risk and control reviews for enterprise architecture and technology initiatives.
• Provide risk and control oversight for the deployment, integration, and configuration of cybersecurity solutions.

People Management

• Lead the daily activities, priorities, and development of the Governance and Risk Management team.
• Provide oversight of GRC and TPRM services delivered by the MSSP, using KPIs and KRIs to monitor performance and drive continuous improvement.
• Manage vendor relationships and contract responsibilities for the GRC and TPRM service stream in support of a strong cybersecurity posture.

Lead the Enterprise Security Training & Awareness Program

• Promote a high level of corporate cybersecurity awareness, including the administration of end‑user cybersecurity courses and periodic phishing simulations.
• Lead the security awareness program through phishing exercises, simulations, and targeted training designed to reinforce secure behaviours across the enterprise.
• Report on phishing simulation results, highlighting progress, trends, and opportunities to improve secure behaviours.
• Educate LCBO enterprise on social engineering attacks through printed posters, simulations, in‑person roadshows at head‑office, warehouses, and regional offices as applicable, and training campaigns.
• Recognize and celebrate employees who report phishing attempts, while addressing repeat risk through targeted coaching and escalation to the appropriate people leader when required.

About You

• 5+ years’ experience in any combination of cybersecurity or information security, information technology, or IT risk management.
• Experience conducting security reviews / risk assessments on new and existing technology solutions.
• Knowledge of security and Risk frameworks such as NIST RMF/CSF, COBIT, ISO 31000/27001, CIS.
• Knowledge of Cloud environments such as Azure, AWS, and Google
• Experience implementing and governing cyber controls, policies, and procedures.
• Experience within the following security domains: GRC, IAM, Security Architecture Governance, Data Protection.
• Experience with Payment Card Industry (PCI‑DSS) compliance.
• Professional certification such as CRISC, CISA, CISM, CISSP.
• Understanding of relevant Ontario provincial and Canadian Federal information security and information privacy legislation.

Benefits

• Health / Dental Benefits
• Access to an Employee & Family Assistance Program
• a Defined Benefit Pension
• Discounts on products and services via Workperks.

There is a world of opportunities at the LCBO…

Join an organization where you can be challenged while achieving your true potential. A place where you can make a positive impact supporting Ontario business and communities. Discover a safe, healthy, diverse, inclusive, and accountable workplace where your wellbeing is our top priority. At the LCBO, your contributions are respected and valued. Be part of our journey as we invest in people and technology to transform an organization. There really is a world of opportunities at the LCBO. We foster a culture of inclusion and belonging, so everyone feels valued, respected, and heard.

The LCBO is an equal opportunity employer and committed to providing employment accommodation in accordance with the Ontario Human Rights Code and the Accessibility of Ontarians with Disabilities Act. If contacted for an interview or employment opportunity, please advise if you require an accommodation. Please submit your resume via Workday by 11:59pm on the deadline date. Your personal information is being collected under the authority of the Liquor Control Board of Ontario Act, 2019, SO 2019, c 15, Sch 21, Section 3 and in compliance with the Freedom of Information and Protection of Privacy Act for the purpose of processing your job application. When you select “Easy Apply”, your personal information will be collected through LinkedIn and shared with the LCBO in accordance with the LinkedIn User Agreement. If you wish to apply without sharing your personal information with LinkedIn, please visit the LCBO Careers website. If you have any questions regarding the LCBO’s collection and use of personal information, please refer to the LCBO Customer Privacy Notice, or contact the Freedom of Information and Privacy Office at: Freedom of Information and Privacy Office 100 Queens Quay East, 9th Floor Toronto, Ontario M5E 0C7 Telephone: [phone] E-mail: [e-mail].

Work Hours: 36.25 Union / Non-Union: Non-Union Job Posting End Date: September 16, 2026

The LCBO (Liquor Control Board of Ontario) is an Ontario government enterprise and one of the world’s largest buyers and retailers of beverage alcohol. Through more than 650 retail stores, catalogues, special order services and more than 389 LCBO Convenience Outlets (LCOs), which provide cost effective, convenient and socially responsible access for rural consumers, the LCBO offers nearly 24,000 products annually to consumers and licensed establishments from more than 80 countries.