Manager, Cyber and Technology Risk Management

Company DescriptionMake an impact at a global and dynamic investment organizationWhen you join CPP Investments, you are joining one of the world’s most admired and respected institutional investors. As a professional investment management organization, CPP Investments invests the funds of the Canada Pension Plan (CPP) to help ensure its financial sustainability for generations of working and retired Canadians.CPP Investments invests across regions and asset classes to build a globally diversified portfolio. It holds assets in public equity, private equity, real estate, infrastructure, and fixed income, and the CPP Fund is projected to reach $ trillion in assets by 2050. The organization is headquartered in Toronto with offices in Hong Kong, London, Mumbai, New York City, San Francisco, São Paulo, and Sydney.CPP Investments successfully attracts, selects, and retains talented individuals from top-tier institutions worldwide. Join our team for access to:Stimulating work in a fast-paced and intellectually challenging environmentAccelerated exposure and responsibilityGlobal career development opportunitiesDiverse and inspiring colleagues and approachable leadersA hybrid-flexible work environment with an emphasis on in-person collaborationA culture rooted in principles of integrity, partnership, and high performanceAn organization with an important social purpose that positively impacts livesIf you have a passion for performance, value a collegial and collaborative culture, and approach work with the highest integrity, invest your career here. Job DescriptionTeam SummaryCyber & Technology Risk Management is the frontline risk partner within the Information & Corporate Security function, working closely with Technology & Data (T&D), Information Security, and business teams to strengthen CPP Investments’ resilience and safeguard critical information and platforms. We provide an enterprise‑wide view of technology and cyber risk for senior leadership and steward the practices and governance that enable secure, reliable delivery of business outcomes.Job DescriptionReporting to the Managing Director, Cyber & Technology Risk Management, this Cyber and Technology Risk Manager role will be focused on mitigating cyber, technology, and data risks by assisting in the implementation of a risk management and internal control framework with particular focus on the Technology & Data (T&D) and Information Security (Infosec) departments.In this role, you will be responsible for working collaboratively with the T&D and Infosec teams to identify, assess, and mitigate risks to the fund’s information systems, data, and infrastructure; and instill a risk and control discipline through education, consultation, and the development of risk management capabilities across core activities. You will assist the team by:Developing and implementing cyber and technology risk management processes and capabilities to protect the organization’s critical information assets and systemsEnabling regular insights via KRIs and other means, to senior leaders and other stakeholders on the fund’s cyber and technology risk postureSupporting the enhancement and implementation of a 1st line of defence risk and control assessment capability,Support the development and updating of key documentation (, standards, guidelines, etc.) to support T&D and Infosec processes and address fund-wide risksFacilitate the establishment of necessary standards and the associated governance and monitoring to ensure adherence and manage exceptionsSupport and lead on-time completion of action plans that address findings from Audits and reviews across the 3 lines of defenseIdentifying risks and partnering with colleagues from Legal, Compliance, Risk, T&D, and Infosec to implement solutions to mitigate themThis role will support the cultivation of the best view of Cyber and Technology risks across the fund through active partnership with T&D teams, Enterprise Risk, Audit, and other groups; and will support the Cyber and Technology Risk Management team in leading enterprise initiatives to address transversal risks impacting the enterprise.You will support the team to work collaboratively with Enterprise and Operational Risk on the adoption and implementation of CPP Investments’ Integrated Risk Framework within T&D and Infosec and support enterprise risk reporting. You will work closely with both Internal and External Audit to identify risks, provide insight to maximize the value of Audit to support the department’s mandate and co-ordinate all audit activities on behalf of T&D and Infosec to assist them in execution of their mandates.QualificationsIf you possess many of the following, we’d like to hear from you:Education & Professional Certifications:Undergraduate degree required, preferably in Technology / Data Science / business / finance or related discipline; post graduate degree is a plus;Industry recognized IT certification (, CISA, CRISC, CISM, CISSP) or equivalent certification is desirable.Professional Experience:Advanced knowledge in IT, risk management, business resiliency, network management/architecture, vendor risk management, vulnerability management, information security, and data protection/management;Minimum 8 years of progressive management experience in technology and/or information risk management experience at complex financial institutions or investment companies;Knowledge of governance, risk, and compliance frameworks such as ITIL, NIST, COSO, COBIT, etc.Ability to evaluate components of an institution’s IT/information security program and provide advice on its ability to identify, protect, respond, and recover from threats and incidents.Ability to understand and communicate complex technical issues to technical and non-technical representatives.Able to make decisions and recommendations that effectively balance risk mitigation objectives with operational impacts to processes and departmentsExpert ability to design and evaluate risk based internal control programs, analyze situations, reach appropriate conclusions and make value-added and practical recommendations;Personal Competencies:Superior communication skills (written and oral) with the ability to take concepts or events and present them simply, concisely and effectively;Strong judgment and creativity; strong problem-solving and analytical skills; ability to effectively process a large volume of information, and draw meaningful/persuasive conclusions;Proven ability to build and foster professional relationships and influence others effectively at senior management, peer, and staff levels;Ability to adapt to rapidly changing business needs and priorities with strong attention to detail and proven consistency;Self-motivated and able to work independently and as part of a team having a “hands on” approach as well as appreciate diversity of thought and opinions;Demonstrated ability to support multiple complex engagements simultaneously, and to prioritize work and efforts of team effectively;Demonstrated willingness and ability to keep abreast of current investment business and professional trends and organizational developments which could impact CPP Investments’ operating and risk environment;