Risk Operations and Visibility Manager

Date Posted: 11/11/2026
Req ID: 50130
Faculty/Division: VP-People, Finance & Digital Services
Department: Information Security
Campus: St. George (Downtown Toronto)
Existing Vacancy: Yes

Description:

The Risk Operations and Visibility Manager position is part of the Information Security Governance Risk and Compliance (GRC) team and will focus on the Risk Operations and Visibility function. This position will be responsible for monitoring and analyzing findings from vulnerability management and attack surface management tools to identify, prioritize, and track information security exposures across the University's environment and consolidating findings from multiple technical sources into a unified risk view of the University's threat landscape.

The incumbent shall possess advance knowledge of IT security tools and technologies amidst a continually evolving threat landscape and to apply such knowledge in evaluating the performance of the operational security risks by producing clear, actionable reporting and risk narratives for technical and non-technical stakeholders, including academic and administrative leadership. They will liaise with distributed IT teams across faculties and divisions to support timely remediation and closure of identified exposures and vulnerabilities while researching, recommending, and supporting the use of software and tools for vulnerability management, attack surface management, and risk reporting to build the internal expertise and function of risk operations and visibility management.

REQUIRED QUALIFICATIONS:

EDUCATION:

• University degree in Computer Science, Engineering, Information security, or equivalent combination of education and experience. A relevant certification (e.g., CompTIA Security+, GIAC GSEC, CRISC, or equivalent) is an strong asset

EXPERIENCE:

• Minimum 5 years of progressive experience in creating, implementing, and maintaining Information Security management programs with a broad range of platforms and technologies
• In-depth knowledge of Information Security controls applicable for web applications, cloud, IoT, mobile applications, networks, and servers
• Minimum 3 years experience performing security assessments of infrastructure (cloud and on-premises), applications and websites
• Minimum 3 years experience working with vulnerability management lifecycle concepts (discovery, scanning, validation, prioritization, remediation tracking) and CVSS/exploitability-based scoring (e.g., EPSS); ability to interpret output from vulnerability scanning tools (e.g., Tenable, Qualys, Rapid7) and attack surface management / cyber security posture management tools (e.g. Falcon, etc.)
• Understanding of Information Security and Risk Management frameworks like ISO27001, ISO27005, NIST CSF and NIST 800-30
• Deep understanding of exposure management and external attack surface management processes
• Experience in grouping individual vulnerabilities and risks for overall reporting purposes
• Experience in threat monitoring and threat intelligence
• Familiarity with legal and regulatory requirements like PCI-DSS, PIPEDA, PHIPA, GDPR etc

SKILLS:

• Able to think strategically about change and new solutions
• Strong writing, communication, presentation and interpersonal skills with the ability to produce high quality, comprehensive communications materials and articulate complex ideas to both technical and non-technical audiences
• Strong leadership and problem-solving skills
• Ability to prioritize and reprioritize work as required
• Adept at conforming to shifting priorities, demands and timelines
• Ability to work both independently and in a team-oriented, collaborative environment
• Proficiency with data analytics and data aggregation; experience with BI/reporting tools (e.g., Power BI, Tableau) and basic scripting (Python, PowerShell) is an asset
• Thirst for knowledge, self-education, and research
• Strong organizational skills in planning and task coordination

OTHER:

Ability to work under pressure of high volume and expectations, while meeting multiple deadlines for multiple projects; strong service orientation coupled with ability to recognize and assess the operational significance of a problem, control/mitigate the risk, and set priorities accordingly. Strong ability to assess risks and controls of computing systems and operations. Demonstrated broad knowledge of information technology, instructional technology, classroom technology, audiovisual technologies, digital signage, network technologies, databases, and application development. Strong ability and willingness to work effectively as a team leader and team member; must be able to collaborate and cooperate with team members, project sponsors, other stakeholders. Ability to lead team members of varying levels and skill sets including Professional/Managerial as well as staff. Must be able to deal calmly and effectively with a variety of people. Demonstrated ability to exercise sound judgment, tact, and diplomacy. Ability to effectively navigate a professional and political climate including assessing the requirement to escalate and issue to more senior levels of management or resources or bodies outside the Faculty; ability to maintain a high level of confidentiality. Ability and willingness to learn new systems, technologies and project management methods and tools.

Closing Date: 12/02/2026, 11:59PM ET
Employee Group: Salaried
Personnel Subarea:PM
Appointment Type: Budget - Continuing
Schedule: Full-Time
Pay Scale Group & Hiring Zone: PM 3 -- Hiring Zone: $97,336 - $113,558 -- Broadband Salary Range: $97,336 - $162,224
Job Category: Information Technology (IT)