Security Risk Oversight Specialist

Winnipeg, MB

• Competitive salary and comprehensive benefits package.
• Defined-benefit pension plan for long-term financial security.
• Nine-day work cycle, typically resulting in every other Monday off to support a balanced approach to work, family life and community.

• Provide recommendations for Technology Security planning and direction.
• Provide Technology Security consulting services to the IT Services Division and the Corporation, including EMS/SCADA systems support, to ensure consistency of security practices across all systems and networks.
• Provide Technology Security Incident Management (manage the reporting, investigation and resolution of data security incidents).
• Conduct Technology Security assessments of systems, applications and networks.
• Support Investigations and Post-Loss Assessments.
• Report on Security Risk and Oversight Activities.
• Track Remediation, Exceptions, and Risk Register Updates.
• Maintain contact with industry security standards setting groups, and an awareness of legislation and regulations pertaining to information security.
• Provide support to all Technology Security compliance requirements.
• Coordinate support for internal and external audits.
• Conduct Technology Security research and keep current on all Technology Security-related issues.

• A four-year degree in Computer Science from an institute of recognized standing with a minimum of five years of related experience including information technology (IT) or industrial control system (ICS) Support experience, including cyber risk management, governance, policy, risk reduction and mitigation, IT and ICS protection, and regulatory requirements related to cybersecurity;
  OR
• A two year diploma in Computer Technology from an institute of recognized standing with a minimum of seven years of related experience including information technology (IT) or industrial control system (ICS) Support experience, including cyber risk management, governance, policy, risk reduction and mitigation, IT and ICS protection, and regulatory requirements related to cybersecurity.
• Certified or be willing to obtain certification as a Certified Information System Security Professional (CISSP) from (ISC)². Certifications such as Cyber Security specific (CISM, CRISC, OSCP, CEH, CGIH, GPE, SANS, ISAACA CSX Cybersecurity Practitioner (CSX-P)), would be an asset.
• An in-depth understanding of Manitoba Hydro's computing and network infrastructures (IT and ICS/CIP) and security programs process and technology.
• In-depth knowledge of best and industry-leading cyber risk management, cyber security concepts, controls, frameworks, policies, standards, tools.
• Strong written and verbal communication skills with a demonstrated ability to communicate effectively, deliver reports, recommendations, and presentations, and the ability to build and maintain harmonious working relationships with staff across the enterprise at all levels.
• Experience supporting data security incident reporting, investigation, resolution tracking, and escalation in accordance with established incident management processes.
• Experience maintaining or supporting a risk register, including tracking risks, issues, remediation actions, exceptions, decisions, and status updates.
• Demonstrated initiative and ability to prioritize and achieve results in a timely manner.
• Experience supporting security investigations, post-loss assessments, root cause analysis, documentation of findings, and tracking of corrective actions.
• Capacity to deal effectively with groups and individuals from all levels of the Corporation.
• Capacity to deal effectively with external organizations and groups.
• Effective communication and presentation skills.
• Excellent writing skills for developing both informational materials and security documentation.
• Capacity to deal effectively with the rapidly changing arena of Technology Security through innovation and creativity. 
• Possess a valid Manitoba Driver's Licence.
• Must obtain and maintain a current Personnel Risk Assessment and a "Clear" security rating in accordance with Manitoba Hydro policy P513.
• Critical Infrastructure Protection (CIP) Training is required and must be completed prior to transfer date and renewed annually.
• Must complete Manitoba Hydro Standards of Conduct training.