Assistant Vice President, IT Risk

IGM Financial Inc.
is one of Canada's leading diversified wealth and asset management companies with approximately $271 billion in total assets under management.
The company provides a broad range of financial planning and investment management services to help more than two million Canadians meet their financial goals.
Its activities are carried out principally through IG Wealth Management and Mackenzie Investments.

Under IGM Financial's unique business model based on leading brands and multi-channel distribution strategy is Mackenzie Investments, founded in 1967.
Mackenzie Investments is a holistic asset-management partner for thousands of Canadian financial advisors and the investors they support.

Role & Responsibility

The AVP, IT Risk is responsible for First Line of Defense for IGM with responsibility for planning, directing, controlling, identifying and managing the inherent operational risks in products, activities, processes and systems across IGM.

This role sets the enterprise risk strategy and risk appetite and matures, expands and optimizes IGM's information risk management capabilities while positioning the organization to be agile and ready to respond to ever-changing threat landscape and security risks.

The AVP directs staff in execution of the risk strategy to ensure information and information technology risks are within acceptable levels.

Risk Strategy

• Responsible for designing, advising, supervising and coordinating the implementation, management and execution of the IGM IT security, risk and compliance framework
• Collaborate with the Executive Leadership team to develop an enterprise security vision and first line of defence strategy
• Develop and publish risk management policies and guidelines including third party risk assessments, penetration testing, vulnerability assessments and continuous monitoring
• Distill and report on issues to leadership and where applicable to 2nd Line of Defense Partners
• Lead discussions with 2nd Line partners about potential solutions to issues identified
• Partner with other members on the Governance and Control teams to assess business and regulatory risk
• Keep abreast of emerging issues, trends, and evolving regulatory requirements to identify new opportunities and assess potential impacts
• Ensure risk issues are identified, managed and reported per enterprise policy/guidelines and ensure appropriate escalation processes are followed

Execution and Operational Support

• Execute on First Line of Defense
• Support experts in the execution of the Agile and Waterfall project methodology across lines of business
• Provides guidance and expert advice into the management of application security risks, and influences the identification, measurement, and management of cyber security risk
• Support the successful launch of new initiatives by finding the right balance of governance and controls while ensuring activities are within IGM's risk appetite and risk management policies
• Be the Subject Matter Expert/first point of contact for respective risk/control function responding in a timely manner to support project execution
• Provide guidance on detailed business requirements for projects to address regulatory requirements and expectations
• Work closely with Transformation delivery teams to provide support, guidance and analysis on business risk and regulatory compliance issues
• Support transparency with 2nd Line of Defense risk control partners through engagement, defined interaction model and issuance of processes, requirements and/or artifacts supporting their mandate of oversight and challenge
• Support for various risk functions within IGM
• Provide consultation and guidance for workstream leads to ensure full understanding of requirements and appropriate risk controls
• Work effectively with 2nd line partners to address issues and emerging risks on new initiatives
• Accountable for ensuring IGM can demonstrate that we are compliant with all relevant cyber security standards and regulations, and supporting and enabling our second and third lines of defense
• Develops and implements an IGM enterprise risk, security and compliance awareness and training program that fosters a culture of continual awareness, accountability and proactive behavior across IGM
• Uses various risk identification, measurement, management and monitoring tools such as Risk and Control Assessments (RCAs), Threat and Risk Assessments (TRAs), Privacy Impact Assessments (PIAs), scenarios, key risk indicators, event reporting, and incident reporting
• Gather metrics and ensure Information security incidents are identified, reported, mitigated and resolved in a timely, accurate and sustainable manner
• Take end to end ownership of cybersecurity owned programs and related activities including security policies, vendor risk and compliance management, regulatory audits, security awareness and training, security integration and assessment of M&A and related ventures
• Works with all levels of the organization to ensure understanding and implementation of IT Risk and Security policies and procedures, processes and controls
• Develop metrics, measurement methodologies, reporting and processes (including Key Risk Indicators) to consolidate, interpret and report enterprise risk information to senior management, Board, regulators and external ratings agencies
• Continuously evaluate cybersecurity controls to ensure effectiveness, compliance and adherence to key controls and policies and drive its remediation efforts
• Selects and identifies the best risk assessment tools to support risk identification, risk impact assessment, risk prioritization and risk tracking in support of the second line of defense, compliance and audit standards, policies and guidelines
• Support ongoing socialization of risk initiatives

Qualifications

• 10+ years of progressively senior IT risk and compliance experience, with experience in top tier management consulting firms preferred
• Strong risk management expertise, with knowledge and experience managing strategic IT risks
• Experience developing financial and nonfinancial risk management methodologies, measures, control frameworks, policies, procedures, standards, guidelines and related processes
• Strong track record of successfully developing and executing risk methodologies in partnership with cross functional teams that achieve intended benefits
• Experience working with legal, audit and compliance staff
• Experience with common information security management frameworks, such as International Standards Organization (ISO) 27001, National Institute of Standards and Technology (NIST) cybersecurity framework, Cloud Security Alliance Cloud Controls matrix and other leading-edge security frameworks
• A strong understanding of the business impact of security tools, technologies and policies
• One or more industry recognized information professional designations
• Knowledge of the Financial Services industry would be an asset

Relevant certifications inclu.