- Location
- Kitchener, Ontario
- Type
- Full-time
- Department
- IT
- Seniority
- Manager
Description
D2L is a cloud company that is modernizing education and building the Future of Work. The old models of teaching and learning are in the midst of the largest transformation in history, and D2L is at the heart of that fundamental shift.
New models of teaching and learning enable a personalized, student-centric experience – and deliver improved retention, engagement, satisfaction, and results for learners of all ages – in schools, campuses, and companies.
D2L is disrupting the way the world learns, by providing the next generation learning environment and solutions to engage and inspire learners. And most importantly, by giving customers a platform that is easy, flexible, and smart. No other company provides a solution as robust and innovative as D2L.
D2L has had a singular mission for 25 years and is dedicated to that same mission in the years ahead: to transform the way the world learns – and by doing so, we will help improve human potential globally.
Every application we receive is personally reviewed by a member of our Talent Acquisition team - yes, a real person looks at your resume! While we use AI tools internally to streamline tasks like meeting notes, summaries, and administrative work, these tools never rank resumes, make hiring decisions, or influence candidate evaluations.
General Description:
The Senior Manager, Corporate Security leads the corporate security function and its day-to-day operations and owns the corporate security roadmap. This role is accountable for protecting the organization’s corporate infrastructure, including identity, endpoints, networks, collaboration and SaaS platforms, and cloud and on-prem environments, through disciplined operations, sound architecture, and risk-based decision-making. The Senior Manager leads and develops a team of security professionals, stays close to high-impact technical work, and partners closely with GRC, Product Security and Corporate Security teams to deliver a consistent, coordinated security program across the organization.
The Senior Manager influences corporate infrastructure standards and investment decisions across IT and engineering, translates security risk into clear business terms for senior leadership, and provides input into budgeting, vendor selection, and vendor performance.
How you'll make an impact:
Corporate Security Leadership & Operations
- Lead, coach, and develop the corporate security team, including hiring, onboarding, performance management, and succession planning.
- Own day-to-day corporate security operations, including vulnerability and patch management, endpoint and email security, SaaS and identity security, and security monitoring.
- Set team priorities, capacity plans, and on-call coverage, and balance operational demands against roadmap delivery.
- Define operating cadences, runbooks, service levels, and metrics so operations are repeatable, measurable, and continuously improving.
- Serve as the escalation point for corporate security issues, and stay hands-on where deep technical judgment is required.
Corporate Security Roadmap & Strategy
- Build, maintain, and communicate the corporate security roadmap (12–36 month horizon), refreshed at least annually and as risk or business priorities change.
- Align the roadmap to business strategy, risk posture, and regulatory requirements, and prioritize initiatives by risk reduction and business impact.
- Translate the roadmap into funded, sequenced initiatives with clear owners, milestones, and success measures.
- Track and report delivery progress, risks, and outcomes to security and IT leadership.
Corporate Infrastructure Influence & Architecture
- Influence corporate infrastructure strategy and design with IT, cloud, and engineering teams so security is built in from the start.
- Define and maintain security standards, guardrails, and reference patterns for cloud and on-prem corporate infrastructure.
- Lead threat modeling and security design reviews for material infrastructure changes, with documented, risk-based recommendations.
- Drive adoption of least privilege, segmentation, hardening baselines, and blast radius reduction across corporate environments.
Partnership with GRC and Product Security
- Partner with GRC on the risk register, control design, evidence, and audit readiness (e.g., SOC 2, ISO 27001, GDPR), providing technical validation for corporate controls.
- Partner with Product Security on shared standards, tooling, vulnerability management, and incident response so corporate and product environments are protected consistently.
- Establish clear responsibilities, handoffs, and escalation paths between Corporate Security, GRC, and Product Security.
- Align roadmaps and priorities across the three groups, and surface cross-cutting risks and dependencies early.
Risk, Controls & Compliance
- Identify, assess, and prioritize corporate information security risks, and provide risk-based input into formal risk acceptance decisions.
- Operate and continuously improve corporate security controls so they are measurable, effective, and aligned with regulatory and internal requirements.
- Regularly assess configuration, access controls, and security posture, and drive remediation to closure.
Detection, Incident Response & Resilience
- Own detection and response capabilities for corporate environments, including tooling, playbooks, and tuning.
- Lead or support response to high-severity security incidents, and coordinate with IT, Legal, Product Security, and leadership as needed.
- Lead post-incident reviews and drive long-term remediation and resilience improvements.
Automation, Platforms & Secure Enablement
- Define and deliver strategies to automate and standardize security controls across corporate platforms, services, and business processes.
- Establish security enablement patterns that integrate with IT and operational workflows.
- Evaluate security tools, platforms, and frameworks for technical fit, operational impact, and risk reduction.
Project Engagement & Delivery
- Provide security direction, requirements, and acceptance criteria for infrastructure and IT projects.
- Review designs and implementations for alignment with security standards and architecture.
- Identify and escalate security-related delivery risks.
Budget & Vendor Management
- Provide input into corporate security budgeting and investment planning, and ensure initiatives and operations stay within approved budget.
- Technically evaluate vendors and tools for security capability, risk, and architectural fit.
- Monitor vendor performance, participate in renewals, and recommend changes based on performance and risk.
Influence, Communication & Enablement
- Act as a trusted advisor to senior leadership on corporate security risks and tradeoffs.
- Translate complex technical security issues into clear, business-focused insights.
- Influence engineering and IT teams through standards, design reviews, and technical leadership.
Success Measures:
- Measurable reduction in corporate infrastructure security risk
- Operational performance of the corporate security function (response and remediation times, coverage, and service levels)
- On-time delivery and business impact of the corporate security roadmap
- Effectiveness and adoption of security standards, architecture, and controls
- Audit outcomes and defensibility, supported by effective collaboration with GRC
- Effective alignment with Product Security and GRC
- Team engagement, development, and retention
- Vendor performance and risk posture
Continuous Improvement:
- Stay current with emerging threats, technologies, and best practices.
- Evaluate and implement new security tools, practices, and frameworks to strengthen corporate security posture and team effectiveness.
What you'll Bring to the Role:
Competencies:
- People leadership: able to build, coach, and retain a high-performing security team.
- Strategic and analytical thinking for risk assessment, prioritization, and roadmap planning.
- Ability to lead technical initiatives and influence cross-functional teams without direct authority.
- Collaboration and partnership across GRC, Product Security, IT, Legal, and engineering.
- Strong communication skills for technical and non-technical audiences, including senior leadership.
- Continuous learning mindset and adaptability to evolving security landscapes.
Skills:
- Cloud security expertise (AWS, Azure) and infrastructure hardening.
- Strong knowledge of network security, firewalls, VPNs, and identity and access management.
- Experience running security operations and managing vulnerability, endpoint, and SaaS security programs.
- Experience with security tools (SIEM, vulnerability scanners, compliance platforms).
- Proficiency in scripting and automation (PowerShell, Python, Bash); familiarity with Infrastructure-as-Code (Terraform, CloudFormation) and CI/CD security integration.
- Understanding of encryption, key management, and secure data handling.
- Ability to build and communicate security roadmaps, business cases, and risk-based recommendations.
Suggested Experience
- Bachelor’s degree in a related field, or equivalent experience.
- 8+ years of progressive information security experience, including 3+ years leading security teams or functions.
- Demonstrated experience building and delivering a security roadmap and operating a corporate or enterprise security function.
- Experience partnering with GRC, audit, and product or application security teams in a SOC 2, ISO 27001, or similar compliance environment.
- Hands-on experience securing cloud (AWS, Azure) and on-prem corporate infrastructure.
- Security certifications such as CISSP, CISM, or CCSP preferred.
The expected base salary range for a new hire in this role is listed below. The annualized base salary offered is determined by each candidate’s relevant knowledge, skills, education, training and experience. It is aligned to ensure both internal and external competitiveness using market data for the geographic location and industry. As part of the total compensation at D2L the role may be eligible for additional benefits including a Wellness Subsidy, Equity Grants, Variable Incentive, and more.
Don’t meet every single requirement? We strongly encourage you to still apply! At D2L, we are committed to creating a diverse and inclusive environment. We encourage your application even if you don't believe you meet every single qualification outlined, because we love to help our people grow and develop!
Why we're awesome:
At D2L, we are dedicated to providing you with the tools to do the best work of your life. While some of our perks and benefits may vary depending on location or employment type, we are proud to provide employees with the following through #LifeAtD2L:
- Impactful work transforming the way the world learns
- Flexible work arrangements
- Learning and Growth opportunities
- Tuition reimbursement of up to $4,000 CAD for continuing education through our SkillsWave Program
- 2 Paid Days off for SkillsWave-related activities like exams or final assignments
- Employee wellbeing (Access to mental health services, EFAP program, financial planning and more)
- Retirement planning
- 2 Paid Volunteer Days
- Competitive Benefits Package
- Home Internet Reimbursements
- Employee Referral Program
- Wellness Reimbursement
- Employee Recognition
- Social Events
- Dog Friendly Offices Spaces at our HQ in Kitchener, Winnipeg, Vancouver and Melbourne offices.