Chief Information Security Officer – Directeur de la sécurité de l'information

atInsurityRemote

Canada Full-time Cybersecurity / Security EngineerLeadC$216k – C$325k/year

Posted Oct 19

This is a fully remote position, open to applicants in Canada.

📋 Description

• Oversee Insurity’s enterprise security, cybersecurity risk management, and privacy initiatives.

• Safeguard Insurity’s information assets, products, customer environments, and technology landscape while facilitating growth, cloud integration, international expansion, and responsible AI application.

• Convert cybersecurity, privacy, compliance, and technology risks into actionable business decisions for executive leadership and the Board.

• Formulate and enhance the enterprise information security strategy, policies, standards, and control framework continuously.

• Set security priorities that align with business strategy, product roadmaps, customer obligations, and risk appetite.

• Strengthen security governance, executive steering committees, and reporting to executive leadership and the Board.

• Clarify security responsibilities across Engineering, Product, Corporate IT, Cloud Operations, Legal, Privacy, and Compliance.

• Lead and enhance HIPAA compliance and ePHI protection initiatives.

• Direct HIPAA risk assessments, control testing, remediation tracking, program evaluations, safeguards, audit evidence, customer due diligence, and incident response.

• Establish and manage enterprise AI security and governance, including AI inventory, risk categorization, approval processes, prohibited uses, human oversight, and generative AI standards.

• Define controls for AI risks such as prompt injection, data leakage, insecure agents, model abuse, data poisoning, supply-chain risks, unauthorized access, and harmful outputs.

• Oversee risk identification, assessment, prioritization, treatment, acceptance, audits, assurance, regulatory updates, cyber-insurance support, and Board reporting.

• Manage security operations, threat intelligence, vulnerability management, detection and response, penetration testing, investigations, and incident responses.

• Coordinate significant incidents and crisis responses alongside the COO, CLO, Legal, Privacy, Compliance, Communications, customers, insurers, law enforcement, and regulators.

• Facilitate cyber crisis tabletop exercises and maintain crisis communication and breach-disclosure playbooks.

• Integrate security-by-design principles across product development, architecture, engineering, DevOps, and change management processes.

• Supervise application security, secure coding, threat modeling, SAST, DAST, software composition analysis, penetration testing, vulnerability disclosure, release gates, and software supply-chain security.

• Oversee cloud security architecture, IAM, encryption, secrets management, network segmentation, logging, monitoring, data loss prevention, and secure configuration management.

• Review and authorize security architecture for products, platforms, infrastructure modifications, AI systems, and customer-facing capabilities.

• Establish third-party security and privacy programs while managing vendor, cloud provider, subprocessor, partner, and supply-chain risks.

• Maintain practices for data classification, inventory, data flow, retention, deletion, residency, and access governance.

• Build and lead a cost-effective security organization; recruit, develop, mentor, and retain security talent.

• Oversee security awareness and role-based training, manage the security budget, partner strategies, managed service providers, and external security resources.

• Define and report on security metrics, risk indicators, maturity measures, control health, remediation progress, incident trends, audit outcomes, customer commitments, and AI governance metrics.

⛳️ Requirements

• Bachelor’s degree in information security, computer science, information technology, business, or a related field; equivalent experience may be accepted.

• 8–10 years of progressive experience in information security, cybersecurity, technology risk, or related fields within a SaaS, cloud, technology, insurance, healthcare, or other regulated environments.

• A minimum of 5 years in an executive or senior leadership role such as CISO, Deputy CISO, Head of Security, or a similar position.

• Proven experience in building and managing an enterprise security program across a distributed or remote organization.

• Familiarity with HIPAA, ePHI, Business Associate requirements, healthcare data protection, or similar regulated data obligations.

• Demonstrated experience in leading security risk assessments, audits, remediation initiatives, and regulatory or customer assurance activities.

• Experience managing significant incidents, crisis responses, business continuity, disaster recovery, and executive communications.

• Experience establishing or operating an AI security, AI governance, responsible AI, model-risk, or secure-generative AI program.

• Strong understanding of cloud, SaaS operating models, identity management, encryption, application security, vulnerability management, incident response, and third-party risk.

• Exceptional written, verbal, presentation, negotiation, and stakeholder-influencing capabilities.

• Proven ability to manage budgets, partners, vendors, priorities, and complex cross-functional initiatives.

• Preferred certifications include CISSP, CISM, CISA, CRISC, CCSP, or equivalent.

• Experience with SOC 2 Type II, ISO/IEC 27001, NIST CSF, NIST AI RMF, or comparable frameworks is preferred.

• Experience in AI/ML security, LLM security, agent security, model risk management, AI impact assessments, or AI red teaming is preferred.

• Experience supporting customer security reviews, RFPs, renewals, and executive-level trust discussions is preferred.

• Experience in insurance technology, property and casualty insurance, healthcare technology, or another data-intensive regulated industry is preferred.

• Familiarity with cyber-risk quantification, cyber insurance, secure software supply chains, DevSecOps, and cloud-native security is preferred.

• Proficiency in English is required for communication with clients, partners, and colleagues outside Québec; French is required for positions based in Québec.