Senior Manager/Manager

Bank on your terms with CIBC – whether it’s in person, over the phone or online, CIBC has you covered. We’re building a relationship-oriented bank for the modern world. As a Senior Manager, Application Security you will join CIBC's Information Security department to continue our journey and evolve the enterprise wide Application Security programs, which strive to ensure that all applications and data across the enterprise have security & protection built into their life cycle, thereby enhancing CIBC’s overall security landscape and protecting Our Bank, Our Clients, and Our Employees.
You’ll have the flexibility to manage your work activities within a hybrid work arrangement where you’ll spend 1-3 days per week on-site, while other days will be remote
Service Governance - Manage and oversee the development and maintenance of strategic roadmaps for the domain of Application Security. Collaborate with various stakeholders on requirements, develop business cases and lead subsequent projects (including POCs) as product owner to support the strategy. Maintain a continuous improvement mindset, always looking for opportunities for efficiency and to enhance the security of the domain.
Communication – Build and present documentation to executive management aimed at communicating benefits of proposed security programs, as well as on current potential risks and providing recommendations. Provide awareness and training to the application developments teams of the benefits of web application layer protection services, data protection services, code scanning services, etc. Assess business needs against potential risks and provide your recommendations to enhance our information security landscape.
Advisory and Relationship Management - Working with the broader team, act as a trusted advisor to influence the application development, operational and infrastructure teams to build security into their design, development and scanning techniques, and to prioritize security vulnerabilities identified using a risk-based approach. Assist in the identification, assessment, reporting, and management of security risks and design flaws identified in key applications with practical and achievable recommendations. Manage the vendor relationship for security services and tools used within the domains of Application Security.
Secure Software Development Lifecycle - Manage API, DAST, Container Security, DevSecOps related service activities, including scheduling, consulting, onboarding, service governance and improvement. Measure the quality of the service protection and conduct threat update review, analysis of trends and usage reports. Drive improvement in the level of security protection for our enterprise applications.
You bring passion for industry web application security, vulnerability management and data security standards and best practices.
You have implemented methodologies to ensure the protection of web applications including exploit, vulnerability and attack detection signatures, security testing and penetration testing. You can demonstrate experience in in application security in a senior level role (i.e. managing SAST, DAST, SCA or similar security service).
DAST, SAST Penetration testing, web application firewalls, runtime protection, mobile application protection and other threat and vulnerability management capabilities. It is an asset if you have current accreditation and good standing CISSP, CISA, or CISM designation.
Your critical thinking & problem solving skills help to inform your decision making.
We work to recognize you in meaningful, personalized ways including a competitive salary , incentive pay, banking benefits, a benefits program*, defined benefit pension plan*, an employee share purchase plan, a vacation offering, wellbeing support, and MomentMakers, our social, points-based recognition program.
You need to be legally eligible to work at the location(s) specified above and, where applicable, must have a valid work or study permit.
Toronto-81 Bay, 14th Floor We’re building a relationship-oriented bank for the modern world. As a Senior Manager, Application Security you will join CIBC's Information Security department to continue our journey and evolve the enterprise wide Application Security programs, which strive to ensure that all applications and data across the enterprise have security & protection built into their life cycle, thereby enhancing CIBC’s overall security landscape and protecting Our Bank, Our Clients, and Our Employees.
You’ll have the flexibility to manage your work activities within a hybrid work arrangement where you’ll spend 1-3 days per week on-site, while other days will be remote
Service Governance - Manage and oversee the development and maintenance of strategic roadmaps for the domain of Application Security. Collaborate with various stakeholders on requirements, develop business cases and lead subsequent projects (including POCs) as product owner to support the strategy. Maintain a continuous improvement mindset, always looking for opportunities for efficiency and to enhance the security of the domain.
Communication – Build and present documentation to executive management aimed at communicating benefits of proposed security programs, as well as on current potential risks and providing recommendations. Provide awareness and training to the application developments teams of the benefits of web application layer protection services, data protection services, code scanning services, etc. Assess business needs against potential risks and provide your recommendations to enhance our information security landscape.
Advisory and Relationship Management - Working with the broader team, act as a trusted advisor to influence the application development, operational and infrastructure teams to build security into their design, development and scanning techniques, and to prioritize security vulnerabilities identified using a risk-based approach. Assist in the identification, assessment, reporting, and management of security risks and design flaws identified in key applications with practical and achievable recommendations. Manage the vendor relationship for security services and tools used within the domains of Application Security.
Secure Software Development Lifecycle - Manage API, DAST, Container Security, DevSecOps related service activities, including scheduling, consulting, onboarding, service governance and improvement. Measure the quality of the service protection and conduct threat update review, analysis of trends and usage reports. Drive improvement in the level of security protection for our enterprise applications.
You bring passion for industry web application security, vulnerability management and data security standards and best practices.
You have implemented methodologies to ensure the protection of web applications including exploit, vulnerability and attack detection signatures, security testing and penetration testing. You can demonstrate experience in in application security in a senior level role (i.e. managing SAST, DAST, SCA or similar security service).
DAST, SAST Penetration testing, web application firewalls, runtime protection, mobile application protection and other threat and vulnerability management capabilities. It is an asset if you have current accreditation and good standing CISSP, CISA, or CISM designation.
Your critical thinking & problem solving skills help to inform your decision making.
We work to recognize you in meaningful, personalized ways including a competitive salary , incentive pay, banking benefits, a benefits program*, defined benefit pension plan*, an employee share purchase plan, a vacation offering, wellbeing support, and MomentMakers, our social, points-based recognition program.
You need to be legally eligible to work at the location(s) specified above and, where applicable, must have a valid work or study permit.
Application Security, Dynamic Application Security Testing (DAST), Secure Software Development Lifecycle, Static Application Security Testing (SAST) Explore more InfoSec / Cybersecurity career opportunities
Find even more open roles in Ethical Hacking, Pen Testing, Security Engineering, Threat Research, Vulnerability Management, Cryptography, Digital Forensics and Cyber Security in general - ordered by popularity of job title or skills, toolset and products used - below.
#