Vice President, Information Security

PTMA Financial Solutions; Quinte West; On-site; CAD 180,000 - 280,000; Full time

Job summary

PTMA Financial Solutions is seeking a VP, Information Security to own and scale the security program end-to-end. You’ll lead strategy, risk, and operations across in-house and partner teams, with board-level accountability and regulatory interactions.

You will direct incident response, IAM/cloud security, and AI governance collaborations, while building a strong security culture and team growth.

Qualifications

• 12+ years in information security, including 5+ years leading a security program or function.
• Security leadership experience at an SEC- or FINRA-regulated firm, such as an investment adviser, broker-dealer, asset manager, or bank.
• Direct experience leading regulatory examinations, audits, and client security due diligence.
• Track record of presenting security risk to boards or audit and risk committees.
• Hands-on incident response leadership, including acting as incident commander.
• Experience managing outsourced security services to service levels (MDR/MSSP).
• Working knowledge of Microsoft cloud security (Entra ID, M365, Azure) and modern cloud/SaaS controls.
• Bachelor’s degree in a related field, or equivalent experience.

Responsibilities

• Own information security strategy, multi-year roadmap, and annual budget.
• Run the firm’s cyber risk assessment cycle and maintain risk register.
• Report program health and incidents to executives and the board.
• Maintain and update the written information security program, policies, and standards.
• Lead security readiness for SEC examinations, audits, client due diligence, and cyber insurance renewals.
• Ensure compliance of security controls with SEC S-P and PCI DSS.
• Partner with Legal on regulatory interpretation and breach decisions.
• Serve as incident commander for security incidents and run tabletop exercises.
• Manage log management, SIEM retention, vulnerability management, and threat intel programs.
• Own security architecture across endpoints, identity, cloud security posture, network, and SASE.
• Set security requirements for cloud initiatives (Microsoft 365, Azure, Fabric, Salesforce).
• Define security/privacy controls for AI adoption with Data & AI teams.
• Run third-party/vendor risk assessments.
• Lead security team development, run awareness training, and build cross-functional relationships.

Skills

Security leadership

Incident response

Regulatory examinations

Board reporting

MDR/MSSP management

Cloud security

SEC/FINRA regulation knowledge

Cross-functional collaboration

Education

Bachelor's degree in a related field

Tools

MDR/MSSP management

Job description

The VP, Information Security is PTMA’s senior security executive and owns our information security program end to end. This leader sets security strategy, runs day-to-day security operations through an in-house team and managed service partners, commands incident response, and represents the program to the executive team, the board, regulators, auditors, and clients.

The role reports to the Chief Information, Data & AI Officer, with a dotted line to the General Counsel and Chief Compliance Officer and a documented right to elevate directly to the CEO and board. That structure gives security the authority to challenge technology decisions as a peer of IT, not a subordinate to it.

We are looking for a builder. Our controls, tooling, and incident response roadmap are in place and maturing. The VP will turn that foundation into a measurable, exam-ready program that scales with our growth and our expanding use of data and AI.

Key responsibilities

_ Program strategy and leadership _

• Own the information security strategy, multi-year roadmap, and annual budget, aligned to PTMA’s business and technology plans.
• Run the firm’s cyber risk assessment cycle, maintain the risk register, and present risk acceptance decisions to executive leadership.
• Report program health, top risks, and incidents to the executive team and the board on a regular cadence, in business terms.

_ Governance, regulatory, and audit _

• Maintain the written information security program, policies, and standards, and keep them current with regulatory change.
• Lead security readiness for SEC examinations, internal and external audits, client due diligence questionnaires, and cyber insurance renewals.
• Own compliance of security controls with SEC Regulation S-P (including incident response and customer notification requirements), SEC Rule 204-2 recordkeeping, and PCI DSS where applicable.
• Partner with Legal and Compliance on regulatory interpretation, breach notification decisions, and client contract security terms.

_ Security operations and incident response _

• Serve as incident commander for security incidents, from detection through containment, notification, and post-incident review.
• Complete and maintain our incident response playbook library, and run tabletop exercises with technical teams and executive leadership.
• Manage managed detection and response and other security service providers to defined service levels.
• Own log management and SIEM retention, vulnerability management, and threat intelligence programs.

_ Security architecture and technology _

• Own the security technology stack across endpoint, email, identity, cloud security posture, network, and secure access service edge.
• Set security requirements for cloud, SaaS, and data platform initiatives, including Microsoft 365, Azure, Microsoft Fabric, and Salesforce.
• Define security and privacy controls for AI adoption in partnership with the Data & AI team and the firm’s AI governance council.
• Run third-party and vendor risk assessments for technology providers.

_ Team and culture _

• Lead, develop, and grow the information security team, with clear career paths and development plans.
• Run security awareness training and phishing simulation programs for all employees.
• Build working relationships across IT, Data & AI, Salesforce, Product, HR, and Compliance so that security is part of how work gets done.

First-year success measures

_ In the first 12 months, the VP will: _

1. 1. Deliver a security strategy and 3-year roadmap, approved by executive leadership, within the first 90 days.
2. 2. Own and present board security reporting independently, with a defined metrics set the board sees every cycle.
3. 3. Close all open findings from the current incident response playbook reviews and complete the remaining playbooks in the roadmap.
4. 4. Run at least one executive tabletop exercise and one technical incident simulation.
5. 5. Refresh the cyber risk assessment, with every high risk carrying an owner, a remediation plan, and a target date.
6. 6. Bring the firm through any SEC examination, audit, or major client due diligence request without a material security finding.
7. 7. Put a written development plan in place for every member of the security team.

Qualifications

_ Required _

• 12+ years in information security, including 5+ years leading a security program or function.
• Security leadership experience at an SEC- or FINRA-regulated firm, such as an investment adviser, broker-dealer, asset manager, or bank.
• Direct experience leading regulatory examinations, audits, and client security due diligence.
• A track record of presenting security risk to boards or audit and risk committees.
• Hands‑on incident response leadership, including acting as incident commander.
• Experience managing outsourced security services (MDR, MSSP) to service levels.
• Working knowledge of Microsoft cloud security (Entra ID, Microsoft 365, Azure) and modern cloud and SaaS security controls.
• Bachelor’s degree in a related field, or equivalent experience.

_ Preferred _

• CISSP, CISM, or equivalent senior security certification.
• Experience building a security program at a mid‑sized firm of 200 to 1,000 employees.
• Familiarity with NIST CSF, CIS Controls, and SEC Regulation S-P requirements.
• Experience with public‑sector clients and their security expectations.
• Exposure to AI governance and the security of AI and data platforms.