Access and Privacy Officer

Winnipeg, MB

• Competitive salary and comprehensive benefits package.
• Defined-benefit pension plan for long-term financial security.
• Nine-day work cycle, typically resulting in every other Monday off to support a balanced approach to work, family life and community.

• Act as an APO for the corporation in accordance with applicable legislation for purposes of The Freedom of Information and Protection of Privacy Act (C.C.S.M. c. F175) (FIPPA), The Access and Privacy Regulation 64/98, The Personal Health Information Act (C.C.S.M. c. P33.5) (PHIA), and The Personal Health Information Regulation 245/97). 
• Oversee and manage the intake, coordination, and response to access to information requests in collaboration with the Access and Privacy Coordinator, CPO, and legal counsel, as required. 
• Lead and support the development, implementation, maintenance, and continuous improvement of the Enterprise Privacy Program, including establishing and maintaining privacy policy, governance, risk and control frameworks, advanced tools, procedures and guidelines. 
• Contribute and lead access and privacy education and awareness initiatives across an assigned portfolio of business areas across the enterprise. 
• Perform privacy risk assessments; plan, design, and complete compliance reviews, reporting and monitoring; and participate in audits.
• Lead and conduct complex privacy impact assessments, providing independent and objective analysis of privacy risks and practical recommendations. 
• Collaborate with project teams to support medium to complex digital and technology-enabled initiatives to ensure privacy requirements are incorporated by design. 
• Provide subject matter expertise in the management of privacy incidents/complaints/breaches, of varying complexity, in a timely and professional manner. 
• Leads and is accountable for all phases of incident response including intake and triage, containment, investigation, reporting, communications, providing recommendations and implementation of corrective actions. Monitor and track incidents to ensure timely resolution and continuous improvement. 
• Proactively provide expert advice to business areas on privacy governance, compliance obligations, and risk management, including matters involving emerging and rapidly changing technologies, enterprise goals, and strategic initiatives.
• Maintain current knowledge on legislation, regulations, privacy frameworks and tools, and market trends to help position Manitoba Hydro for future regulatory and technological shifts and provide subject matter expertise to allow the business to make informed decisions.
• Provide guidance, mentorship and support to Privacy Office team members through coaching and knowledge sharing to strengthen overall team capability. 

• Completion of a four-year degree program in business, law, technology, information management, or other relevant discipline from a university of recognized standing and six years of directly related experience. 
  OR 
• Two-year diploma in business, technology, information management, or other relevant discipline and eight years of directly related experience.
• Directly related experience must include access to information and privacy governance, risk management, compliance, investigations, and advisory services, preferably within a Canadian public body or regulated environment, combined with progressively responsible work experience as a professional, demonstrating the skills and abilities required for the position. 
• Professional privacy certification (i.e. CIPP/C, CIPM) or equivalent is required. 
• Expert knowledge and demonstrated experience interpreting and applying applicable legislation and regulations for a public body and in a complex regulated business environment.
• Expert knowledge and demonstrated experience handling access to information requests under FIPPA and PHIA.
• Advanced knowledge and demonstrated experience with privacy and risk frameworks, including the NIST Privacy Framework, ISO/IEC 27701:2025, and ISO 31000. 
• Results driven and proactive, with a demonstrated ability to manage ambiguity, tight deadlines, and constraints, while adapting to meet the ever-changing needs of the organization.
• Excellent interpersonal skills with the ability to advise and influence stakeholders at all levels.
• Excellent written and verbal communication skills with a demonstrated ability to effectively communicate and influence stakeholders at all levels, deliver reports, recommendations, and presentations.
• Excellent analytical, research, and problem-solving skills.
• High degree of integrity, discretion, and professional judgment.
• Ability to operate effectively at both strategic and operational levels, with a focus on adaptability and continuous improvement.
• Demonstrated experience in medium to complex digital/technological projects and initiatives as it relates to privacy and data protection.
• Knowledge of the utility industry would be an asset.
• Results driven and proactive, with a demonstrated ability to manage ambiguity, tight deadlines, and constraints, while adapting to meet the ever-changing needs of the organization.
• Must obtain and maintain a current Personnel Risk Assessment and a "Clear" security rating in accordance with Manitoba Hydro policy P513.