![Canadian National Railway](https://media.trabajo.org/img/noimg.jpg)
Expert, Information Security Third Party Risk Management
2 weeks ago
At CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely and our employees can focus on value-added tasks. You will be able to develop your skills and career in our close-knit, safety-focused culture working together as ONE TEAM. The careers we offer are meaningful because the work we do matters. Join us
Job Summary
The purpose of this role is to maintain and grow an industry leading Information Security Third Party Risk Management (TPRM) practice to support the mission of empowering the business by building resilience against evolving cyber threats. This will include program governance, policy and guideline development, risk assessments, information protection contract clauses, continuous monitoring, compliance assessments, regulatory compliance assurance, due diligence and selection processes, technology and tool development and maintenance, cloud transformation, and stakeholder awareness and communication.
This role oversees the development and operations of the third-party security function within CN's Chief Information Security Office (CISO). It interfaces with a variety of senior stakeholders within I&T and the business in order to develop and influence the required changes for the management of third-party security risks originating from suppliers, customers, subsidiaries, and cloud-based technology tools and platforms, to a level that is manageable and aligned to CN's business risk tolerance. They are a senior resource with an understanding of how to apply deep technical knowledge while coordinating activities between multiple internal groups and third-party organizations to enable business objectives by ultimately managing risk to a level that is acceptable for the organization.
Main Responsibilities
Practice Development and Planning
• Align third party information security with organizational business goals
• Oversee a broad range of Information Security activities related to third party suppliers, solutions, subsidiaries and customers, including large outsourcing initiatives (e.g. I&T infrastructure and help desk managed services)
• Develop and maintain a set of policies & guidelines specific to protecting CN's assets where they are accessed or managed by third parties
• Create and maintain a TPRM practice, including a framework for evaluating and managing third party risk
• Ensure information security requirements are integrated with procurement processes
• Proactively monitor emerging trends and evolving threat landscapes to identify innovative ideas that would position CN to be an industry leader
Operation and Execution
• Identify, assess, and report critical and high risks involving third parties
• Manage and escalate incidents such as a material control weaknesses and security breaches and working with the Security Operations Centre (SOC) as required
• Report critical non-compliances and high risks to the appropriate business stakeholders
• Write and negotiate contractual terms internally and with external partners and suppliers to ensure CN's business goals are met relating to information security
• Ensure CN's Information Security policies & guidelines related to third parties meet regulatory requirements for security and privacy protection (e.g. TSA directives, CCSPA requirements, privacy bills, etc.)
• Enhance existing processes through innovation and continuous improvement
• Subject Matter Expertise
• Drive action across various internal and external stakeholders by communicating technical and process requirements
• Provide leadership and expertise on matters relating to third party information security to various internal stakeholders, including I&T, Procurement, Internal Audit, Legal, Facilities Management, and Insurance teams
• Discover and bring to light innovation opportunities and influence other groups to support and implement changes that will generate business value
• Mentor resources, provide knowledge transfer, and delegate support tasks
Organizational Impact
Decision Making & Impacts
The Expert, Information Security Third Party Risk Management implements the governance, risk, and compliance capabilities required to bring Information Security risks involving third party suppliers, solutions, subsidiaries, and customers to acceptable levels required to enable to enable the organization to achieve its business objectives.
To achieve this they conduct strategic planning, create and maintain processes and tools, and coordinate activities between various internal teams and external organizations.
Level of Interaction/Influence
The Expert, Information Security Third Party Risk Management influences and drives action among various areas within the organization, including Legal, Procurement, Internal Audit, Facilities Management, Insurance, and different areas within I&T. They also drive action within external subsidiaries, suppliers, and customers.
This would include incorporating Information Security requirements into procurement processes, ensuring I&T asset inventory systems include relevant data, influencing behaviours of Solution Architects to identify and mitigate high risks, negotiating contractual terms with Legal and Facilities Management, providing expertise to Internal Audit and Insurance teams, issuing Cybersecurity Policies and conducting compliance monitoring activities on subsidiaries, influencing external agencies and service providers to better align to CN's needs, working with customers on Information Security requirements and posture, and many other interactions with various internal and external stakeholders.
Requirements
Education/Certification/Designation
• B.S. degree in Computer Science, Information Systems or other related field, or equivalent work experience
Skills/Knowledge
• Broad skillset and depth of expertise in technical areas of information security and how they impact business objectives
• Demonstrated capability to understand the security implications of complex business operations and how they are linked to technological solutions that provide practical risk mitigation and business enablement
• Good knowledge of existing and emerging technologies and architecture principles involved in complex information and technology systems
• Significant and proven experience in applying a structured approach to problem resolution
• Sufficient knowledge on matters relating to third party information security
• Excellent written and verbal communication skills as well as business acumen
• Detail-oriented self-starter with a high level of commitment and personal motivation
• Knack for prioritizing tasks and working in a fast-paced environment
• Able to learn quickly to keep pace with rapidly evolving technology and cybersecurity environments
• Able to lead initiatives to completion with minimal management oversight
• Able to communicate in a clear, concise manner
• Experience with contract and supplier negotiations
• Able to multi-task and work effectively across multiple organizational units
• Security assessment experience
• Strong understanding of security frameworks including NIST CSF, NIST SP 800-53, and ISO-270001
• Strong understanding of regulatory requirements including SOX, PIPEDA, HIPAA and TSA
• Deep understanding of security threat landscape
• Ability to translate complex technical topics into simple business language for business audiences
• Experience developing and delivering executive level presentations
• Relationship management skills
• Experience dealing with third parties
• Strong process orientation
• Recognized security certifications (e.g. CISSP, CISM, CRISC, CISA)
Specific skills per speciality
Experience
• Minimum 5 years experience in Information Security
• 10+ years of I&T experience or 5+ years in a similar role
• 10-15 years overall work experience
• Assets
• Knowledge of railway systems
• Good understanding of Cloud Computing
• Understanding of both IT and OT systems
Working Conditions
Occasional business travel (Canada and US) in accordance with CN policy
This position is posted as a grade LEVEL 7. For internal candidates, note that the grade level of the position may adjust based on the employee's experience.
About CN
CN is a world-class transportation leader and trade-enabler. Essential to the economy, to the customers, and to the communities it serves, CN safely transports more than 300 million tons of natural resources, manufactured products, and finished goods throughout North America every year. As the only railroad connecting Canada's Eastern and Western coasts with the Southern tip of the U.S. through a 19,500 mile rail network, CN and its affiliates have been contributing to community prosperity and sustainable trade since 1919. CN is committed to programs supporting social responsibility and environmental stewardship. At CN, we work as ONE TEAM, focused on safety, sustainability and our customers, providing operational and supply chain excellence to deliver results.
For internal candidates, note that the grade level of the position will depend on the employee's experience.
. click apply for full job details
-
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely...
-
Expert Product Management
2 weeks ago
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely...
-
Expert Product Management
2 weeks ago
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely...
-
Senior Infrastructure Security Engineer
4 weeks ago
Don Mills South (Flemingdon Park), Canada Ripple Full timeAt Ripple, we're building a world where value moves like information does today. It's big, it's bold, and we're already doing it. Through our crypto solutions for financial institutions, businesses, governments and developers, we are improving the global financial system and creating greater economic fairness and opportunity for more people, in more places...
-
Bilingual Nurse Case Manager
1 day ago
Don Mills South (Flemingdon Park), Canada Bayshore HealthCare Full timeAbout the Role The Nurse Case Manager (NCM) will play an essential role in supporting patients with reimbursement support to physicians and medical case management services to patients. Assist the physician with the completion of all program specific paperwork and follow up on submissions pertaining to obtaining drug reimbursement/coverage through private...
-
TDS Operations Analyst II
2 weeks ago
Don Mills South (Flemingdon Park), Canada TD Bank Full timeWork Location : Toronto, Ontario, Canada Hours: 37.5 Line of Business: TD Securities Pay Details: We're committed to providing fair and equitable compensation to all our colleagues. As a candidate, we encourage you to have an open dialogue with a member of our HR Team and ask compensation related questions, including pay details for this role. Job...
-
Conseiller(ère) Aux Ventes
4 weeks ago
Greenfield Park, Canada Party Expert Full time_Le genre masculin est utilisé sans aucune discrimination et dans le seul but d'alléger le texte._ Vous aimeriez travailler dans un environnement des plus excitants! Vous êtes passionné et inspirant? Party Expert est une entreprise Québécoise, reconnue pour sa vaste sélection de produits reliés aux fêtes et célébrations de tous genres. Chef de...
-
Medical Writer
4 weeks ago
Don Mills South (Flemingdon Park), Canada Inizio Engage Full timeMedical Writer (Medical Information Lead)Inizio Engage Canda is seeking a team of Medical Information Leads that is focused on executing content creation for multiple channels in therapeutic area(s) to assure scientifically accurate, impactful communications to patients, HCPs, and/or access stakeholders. The Medical Information Lead will be reporting to the...
-
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely...
-
Assistant(E) Gérant(E) Du Magasin
3 weeks ago
Greenfield Park, Canada Party Expert Full time_Le genre masculin est utilisé sans aucune discrimination et dans le seul but d'alléger le texte._ Vous aimeriez travailler dans un environnement des plus excitants! Vous êtes passionné et inspirant? Party Expert est une entreprise Québécoise, reconnue pour sa vaste sélection de produits reliés aux fêtes et célébrations de tous genres. Chef de...
-
Senior Medical Writer
4 weeks ago
Don Mills South (Flemingdon Park), Canada Inizio Engage Full timeInizio Engage Canada is seeking a Senior Medical Writer (Senior Medical Information Lead) that is focused on executing content creation for multiple channels in therapeutic area(s) to assure scientifically accurate, impactful communications to patients, HCPs, and/or access stakeholders. This role is majority remote working with the possibly of less than 25%...
-
Senior Manager, Program and Project Management
2 weeks ago
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely...
-
Senior Manager, Program and Project Management
2 weeks ago
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely...
-
Audit Manager II, Global Finance
2 weeks ago
Don Mills South (Flemingdon Park), Canada TD Bank Full timeWork Location: Toronto, Ontario, Canada Hours: 37.5 Line of Business: Audit Pay Details: We're committed to providing fair and equitable compensation to all our colleagues. As a candidate, we encourage you to have an open dialogue with a member of our HR Team and ask compensation related questions, including pay details for this role. Job...
-
Audit Manager I, Global Finance
2 weeks ago
Don Mills South (Flemingdon Park), Canada TD Bank Full timeWork Location: Toronto, Ontario, Canada Hours: 37.5 Line of Business: Audit Pay Details: We're committed to providing fair and equitable compensation to all our colleagues. As a candidate, we encourage you to have an open dialogue with a member of our HR Team and ask compensation related questions, including pay details for this role. Job...
-
Manager of Engineering Delivery
4 weeks ago
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN, we work together to move our company-and North America-forward. Be part of our Information & Technology (I&T) team, a critical piece of the engine that keeps us in motion. From enterprise architecture to operational technology, our teams use the agile methodology to automate and digitize our railroad ensuring our operations run optimally and safely...
-
Don Mills South (Flemingdon Park), Canada Ripple Full timeAt Ripple, we're building a world where value moves like information does today. It's big, it's bold, and we're already doing it. Through our crypto solutions for financial institutions, businesses, governments and developers, we are improving the global financial system and creating greater economic fairness and opportunity for more people, in more places...
-
Specialist, Configuration Management
3 weeks ago
Don Mills, Canada L3Harris Technologies Full timeConfiguration Management Specialist L3HARRIS WESCAM Division Toronto, Ontario About L3HARRIS WESCAM As a subsidiary of L3Harris Technologies and within the Integrated Mission Systems Segment, the WESCAM division develops the most advanced optical sensor and targeting systems for global defense and military sectors, National Security, Search & Rescue and...
-
Assistant Track Supervisor
2 weeks ago
Don Mills South (Flemingdon Park), Canada Canadian National Railway Full timeAt CN,everyday brings new and exciting challenges. You can expect an interestingenvironment where you're part of making sure our business is running optimally and safely helping keep the economy on track. We provide the kind of paid training and opportunities that long-term careers are built on and we recognize hard workers who strive to make a difference....
-
Project Manager(Call Center)design
3 weeks ago
Don Mills, Canada Bell Canada Full timeReq Id: 411161 At Bell, we do more than build world-class networks, develop innovative services and create original multiplatform media content - we advance how Canadians connect with each other and the world. If you’re ready to bring game-changing ideas to life and join a community that values, professional growth and employee wellness, we want you on...