Manager, Information Security Risk

at  Sun Life

You are as unique as your background, experience and point of view. Here, you’ll be encouraged, empowered and challenged to be your best self. You’ll work with dynamic colleagues - experts in their fields - who are eager to share their knowledge with you. Your leaders will inspire and help you reach your potential and soar to new heights. Every day, you’ll have new and exciting opportunities to make life brighter for our Clients - who are at the heart of everything we do. Discover how you can make a difference in the lives of individuals, families and communities around the world.

PREFERRED SKILLS:

• Broad experience in information security processes (e.g., risk management, pen testing, vulnerability scanning) and controls (e.g., IDS, SIEM, anti-malware, system hardening), and knowledge of systems at Sun Life is an asset

ABOUT THE ROLE:

The role is in the second line of the three lines of defense model and is required to strengthen the second line Information Security Risk Management program. Oversight of this key operational risks will be delivered by independently reviewing, challenging, and reporting on Sun Life’s management of these risks.

WHAT WILL YOU DO?

• Direct the execution and maintenance of the second line’s Information Security Risk Management program:
• Assist in annual challenge of Information Security Risk Policy, Enterprise Operating Guideline and supporting Directives
• Conduct proactive, integrated challenge of key first line activities including incident handling and key strategic projects
• Assist in challenge of middle and senior management’s Risk and Control Self Assessments (RCSA)
• Collaborate with the first line of defense (1LOD) to establish and renew KRIs
• Challenge and report on significant and material information security incidents and Operational Risk Events (OREs)
• Recommend new first line processes for oversight
• Maintain real-time dashboard of Information Security Risk profiles across Sun Life’s Business Groups
• Assist in conducting annual NIST Cyber Security Framework challenge and report on significant and material observations and gaps
• Stay current with industry best practices and trends
• Establish influential relationships with key stakeholders. Influence innovative solutions in response to constraints and conduct challenges in a professional manner
• Apply creative problem-solving skills to broadly defined and occasionally nebulous problems.
• Aggregating and authoring information security risk information for quarterly reporting and providing challenge as appropriate for key forums