Team Lead, Cyber Security Exposure Management

City of Calgary; Calgary; Hybrid; CAD 110,000 - 140,000; Full time

Benefits offered by this job

Remote work option

Job summary

The City of Calgary is seeking a Team Lead for Cyber Security Exposure Management. You will lead a team of cyber security professionals, set work priorities, and advance the maturity of the exposure management function within the City’s cyber security program.

You will define criteria for exposure prioritization, coordinate with governance forums, and drive governance practices and reporting to improve risk reduction across IT and OT environments.

Qualifications

• 8+ years of relevant cyber security employment experience or 4+ years with a degree.
• One or more recognized cyber security, risk management or architecture certifications required (e.g., CISSP, CCSP, CISA, CISM, CRISC, SABSA, TOGAF or GIAC).
• Senior level experience in cyber security exposure management, vulnerability management, malware analysis, penetration testing/Red Teaming, security assurance, or control validation.

Responsibilities

• Provide leadership, coaching, and mentorship to a team of cyber security professionals and align priorities with the City’s mandate.
• Lead development and operation of the exposure management program and its integration into the Cyber Security operating model.
• Build relationships with City colleagues and external partners to support exposure identification, prioritization, treatment, and verification.

Skills

Leadership

Mentorship

Stakeholder communication

Strategic thinking

Education

Diploma in Computer Science/Cyber Security/Information Technology/Risk Management

Bachelor's degree in Computer Science/Cyber Security/Information Technology/Risk Management

Tools

CISSP

CCSP

CISA

CISM

CRISC

SABSA

TOGAF

GIAC

Job description

If you are committed to public service, enjoy collaborating with others, share our values and have a desire to learn and grow, join The City of Calgary. City employees deliver the services, run the programs and operate the facilities which make a difference in our community. We support work-life balance, promote physical and psychological safety, and offer competitive wages, pensions, and benefits. Together we make Calgary a great place to make a living, a great place to make a life.

The City is committed to fostering a respectful, inclusive and equitable workplace which is representative of the community we serve. We welcome those who have demonstrated a commitment to upholding the values of equity, diversity, inclusion, anti‑racism and reconciliation. Applications are encouraged from members of groups that are historically disadvantaged and underrepresented. Accommodations are available during the hiring process, upon request.

The City of Calgary's Cyber Security Business Unit safeguards information, technology, and operational systems that enable the delivery of services to Calgarians.

As the Team Lead, Cyber Security Exposure Management

You will be accountable for the City's cyber security exposure management program, a foundational capability for managing cyber security risk. The program provides cyber security posture insights across enterprise assets, including data, processes, and IT and OT technology systems, to inform risk-based treatment decisions and strengthen business resilience.

Primary duties include:

• Provide leadership, coaching, and mentorship to a team of cyber security professionals, establish work priorities, and advance the growth and continuous improvement of the exposure management function and the City's Cyber Security mandate and roadmap.
• Lead the development, implementation, operation, and continuous improvement of the City's cyber security exposure management program and its integration into the broader Cyber Security operating model.
• Build and maintain collaborative and productive relationships with City colleagues, business units, and external partners to support exposure identification, prioritization, treatment, and verification across IT and OT environments.
• Define and operationalize criteria for exposure prioritization and provide recommendations and escalation to Cyber Security leadership and governance forums regarding material exposures, treatment decisions, exceptions, and unresolved vulnerabilities.
• Establish and evolve structures, methodologies, processes, and governance practices that support effective exposure management and enable outcome-based metrics and reporting for coverage, performance, assurance and compliance.

Qualifications

• A diploma in Computer Science, Cyber Security, Information Technology, Risk Management, or a related field combined with at least eight (8) years of relevant employment experience; OR
• A degree in Computer Science, Cyber Security, Information Technology, Risk Management, or a related field combined with at least (4) years of relevant employment experience.
• One or more recognized and current cyber security, risk management or architecture certifications, such as CISSP, CCSP, CISA, CISM, CRISC, SABSA, TOGAF or GIAC are required; combinations of education and experience may be considered.
• Demonstrated employment experience at a senior level in cyber security exposure management, vulnerability management, vulnerability and malware analysis, penetration testing / Red Teaming, security assurance, or control validation is required.
• Previous employment experience leading teams would be considered an asset.
• Previous employment experience within cyber security functions in complex, public sector, or highly regulated environments would be considered an asset.
• Success in this position requires:
• Empathy and active listening, along with highly developed verbal and written communication skills;
• Ability to distill complex security concepts clearly for a non-technical audience while operationalizing cyber security frameworks, vulnerability scoring methodologies, exploitability and criticality criteria with technical specialists;
• Ability to influence organizational outcomes, resolve competing priorities, and drive alignment and shared responsibility for cyber security risk reduction across technical and business teams;
• Ability to navigate complexity, provide strategic direction, and exercise sound judgement in support of organizational objectives and evolving risk landscapes.

Working Conditions

Occasional coordination with vendors, project teams, or other interested parties outside of regular business hours may be required to support deadlines or time-sensitive activities.

Pre-employment Requirements

• A security clearance will be conducted.
• Successful applicants must provide proof of qualifications.

Workstyle

• This position may be eligible to work from home for at least part of the time as one of several flexible work options available to City employees. These arrangements depend on the operational requirements of the role, employee suitability, and are subject to change based on operational needs and corporate direction.