Senior Manager, Cybersecurity Governance and Risk Management

Location Address:

100 Queens Quay East, 9th Floor, Toronto

Number of Openings:

1

Pay:

$96,244.00 - $178,668.00

Job Posting Description:

Senior Manager,

Governance & Risk Management

This is an onsite role [#LI-Onsite]

Are you passionate about overseeing cyber risk management and developing a team of cybersecurity professionals? Reporting to the Director, Cybersecurity, you will develop and operate the LCBO's information security program and manage cybersecurity governance and risk activities. The senior manager ensures our cybersecurity policies, standards, and procedures are in place and followed while implementing risk assessments and providing oversight and challenge to third-party security service providers.

You will also partner with the security architecture practice and lead the development and management of the security training and awareness program while also supporting the reporting function to the Core executive team and Board-level communications. Finally, you will conduct security risk assessments as they relate to all projects that are funneled through the IT Division, including supporting RFP responses.

If you have strong cybersecurity experience and enjoy leading a team, then this is the role for you!

About the Role

Develop an IT Risk and Security Management Framework

• Be a trusted advisor across all LCBO divisions to identify data and technology-based risks, giving partners expert and realistic analysis to inform their decision-making process.
• Conduct regular threat risk assessments (TRA) to identify cybersecurity risks and recommend mitigation strategies. Maintain the TRA process and associated artefacts.
• Evaluate the adequacy of the security controls for our information and technology systems.
• Manage the LCBO-wide information security compliance program, ensuring IT activities and procedures meet defined requirements.
• Develop cybersecurity governance documents (policies, standards, baselines, and guidelines) in compliance with relevant legislation and best practices.
• Conduct cybersecurity assessments of third-party vendors and partners to ensure adherence to LCBO's cybersecurity policies.
• Lead the Third-Party Risk Management program, assign resources to facilitate TPRM across LCBO, and promote awareness and a culture of risk management across the enterprise.
• Continuously improve risk management practices and organizational readiness to respond to evolving cyber threats.
• Oversee enterprise-wide tabletop exercises, identify gaps, and track the associated lessons learned and next steps.
• Manage the executive security risk dashboard, highlighting material risks, trends, and required actions.
• Report and communicate with Executive Core team regarding our risk posture.
• Provide oversight of Managed Security Service Provider services supporting GRC and TPRM and develop metrics to ensure adequate service delivery.

Risk Assessment and Control Assurance

• Recommend cybersecurity improvements and identify risk and control requirements for upgrades and/or new technologies to enhance the security posture.
• Provide practical, risk-based recommendations to address cybersecurity problems in a cost-effective manner.
• Provide security risk and control guidance in support of new technology deployments and projects to improve overall enterprise security.
• Participate in security risk and control reviews for enterprise architecture and technology initiatives.
• Provide risk and control oversight for the deployment, integration, and configuration of cybersecurity solutions.

People Management

• Lead the daily activities, priorities, and development of the Governance and Risk Management team.
• Provide oversight of GRC and TPRM services delivered by the MSSP, using KPIs and KRIs to monitor performance and drive continuous improvement.
• Manage vendor relationships and contract responsibilities for the GRC and TPRM service stream in support of a strong cybersecurity posture.

Lead the Enterprise Security Training & Awareness Program

• Promote a high level of corporate cybersecurity awareness, including the administration of end-user cybersecurity courses and periodic phishing simulations.
• Lead the security awareness program through phishing exercises, simulations, and targeted training designed to reinforce secure behaviours across the enterprise.
• Report on phishing simulation results, highlighting progress, trends, and opportunities to improve secure behaviours.
• Educate LCBO enterprise on social engineering attacks through printed posters, simulations, in-person roadshows at head-office, warehouses, and regional offices as applicable, and training campaigns.
• Recognize and celebrate employees who report phishing attempts, while addressing repeat risk through targeted coaching and escalation to the appropriate people leader when required.

About You

• 5+ years’ experience in any combination of cybersecurity or information security, information technology, or IT risk management.
• Experience conducting security reviews / risk assessments on new and existing technology solutions.
• Knowledge of security and Risk frameworks such as NIST RMF/CSF, COBIT, ISO 31000/27001, CIS.
• Knowledge of Cloud environments such as Azure, AWS, and Google
• Experience implementing and governing cyber controls, policies, and procedures.
• Experience within the following security domains: GRC, IAM, Security Architecture Governance, Data Protection.
• Experience with Payment Card Industry (PCI-DSS) compliance.
• Professional certification such as CRISC, CISA, CISM, CISSP
• Understanding of relevant Ontario provincial and Canadian Federal information security and information privacy legislation

We offer a comprehensive suite of benefits including:

• Health/Dental Benefits

• Access to an Employee & Family Assistance Program
• a Defined Benefit Pension
• Discounts on products and services via Workperks.

There is a world of opportunities at the LCBO…

Join an organization where you can be challenged while achieving your true potential. A place where you can make a positive impact supporting Ontario business and communities. Discover a safe, healthy, diverse, inclusive, and accountable workplace where your wellbeing is our top priority. At the LCBO, your contributions are respected and valued.  Be part of our journey as we invest in people and technology to transform an organization. There really is a world of opportunities at the LCBO.

We foster a culture of inclusion and belonging, so everyone feels valued, respected, and heard. The LCBO is an equal opportunity employer and committed to providing employment accommodation in accordance with the Ontario Human Rights Code and the Accessibility of Ontarians with Disabilities Act. If contacted for an interview or employment opportunity, please advise if you require an accommodation.

Please submit your resume via Workday by 11:59pm on the deadline date.  We appreciate your interest and advise that only those selected for an interview will be contacted.

Your personal information is being collected under the authority of the Liquor Control Board of Ontario Act, 2019, SO 2019, c 15, Sch 21, Section 3 and in compliance with the Freedom of Information and Protection of Privacy Act for the purpose of processing your job application. When you select “Easy Apply”, your personal information will be collected through LinkedIn and shared with the LCBO in accordance with the LinkedIn User Agreement.

If you wish to apply without sharing your personal information with LinkedIn, please visit the LCBO Careers website. If you have any questions regarding the LCBO’s collection and use of personal information, please refer to the LCBO Customer Privacy Notice, or contact the Freedom of Information and Privacy Office at:

Freedom of Information and Privacy Office

100 Queens Quay East, 9th Floor

Toronto, Ontario M5E 0C7

Telephone: 416 864-2462

E-mail: [email protected]    

Work Hours:

36.25

Union / Non-Union:

Non-Union

Job Posting End Date:

September 16, 2026

The LCBO is an equal opportunity employer and committed to providing employment accommodation in accordance with the Ontario Human Rights Code and the Accessibility for Ontarians with Disabilities Act.