Manager, Information Systems Security

Date Posted: 02/22/2022
Req ID: 22697
Faculty/Division: Faculty of Applied Science & Engineering
Department: Information Technology Office
Campus: St. George (Downtown Toronto)

Description:

Reporting to the Director, Information Technology the Information Systems Security Manager is responsible for working with Information Technology staff and resources at the Faculty of Applied Science and Engineering and across the University to efficiently and effectively address the management, control, and protection of Digital Assets in support of the Faculty’s education and research mission. The Manager is also responsible for conducting and facilitating risk and privacy assessments, maintaining data asset inventory, leading incident response and investigations, and ensuring on-going cybersecurity outreach.

The Manager works with departments and units across the Faculty with the aim of minimizing the risk of compromise to all Faculty’s IT services and resources, analyzing gaps and vulnerabilities, effectively solving security and privacy risk issues, integrating new systems with current systems, and initiating projects to augment and improve service delivery.

The Manager actively monitors cyber threats and works to ensure systems, servers and computing solutions administered by the Faculty are secure, available, and that appropriate disaster recovery and business continuity plans are in place and regularly tested.

The Manager provides strategic and tactical planning, evaluation, design, development, implementation, and overall management and support of the Faculty’s Information Security and Risk Management Program with the goal to protect and improve the Faculty’s cybersecurity infrastructure, posture, and culture.

The Manager is instrumental in ensuring reliable and robust access controls are in place. The incumbent applies known security standards and best practices related to the use and operation of information and communication technology solutions, systems, servers, services, Cloud services and proposes strategies by which those standards and best practices are implemented, tested, and confirmed on a regular basis. The incumbent reviews the performance of security controls, and effectiveness of projects to achieve the security goals of the Faculty IT portfolio.

The Manager acts as a project manager for projects that fall within their area of responsibility and collaborates with departmental and faculty-wide groups (ISTEP, Engineering Computing Facility, Engineering Career Center, Office of the Registrar, Recruitment, etc. …) to ensure that all projects containing confidential and restricted information follow the information security standards and best practices for Identity and Access Management, Information Disclosure, Information Integrity, Business Continuity and Protection of Privacy.

The Manager establishes and manages strong relationships with all levels of the FASE community including executive leadership, project teams, clients, stakeholders, and IT departments across the Faculty and the University of Toronto to promote cybersecurity awareness. Work is done in collaboration with institutional partners including other Divisions, ITS, FIPP office and others.

Education:

University degree in Computer Science, Engineering, or an equivalent combination of education and experience. A Graduate Degree and certifications in information security and management, such as CISSP, CISA, ISO Audit, PMP, CRISC or other relevant certifications, are an asset.

Experience:

At least seven (7) years of progressive responsibility working in an Information Technology environment, including at least three years working with Information Security as a prime focus of activity. Strong understanding of IT Architecture concepts and security methodologies. Experience auditing systems for compliance (PCI-DSS, PA-DSS, etc.). Experience drafting information security standards and guidelines, assessing risk management, and determining controls. Experience in administering enterprise-level Microsoft and Unix-based server applications. Strong scripting skills required including Shell and interpreted languages. Experience with application / scripting tools (PowerShell, Python, Perl). Experience configuring databases and database- backed applications (SQL Server, MySQL). Extensive experience using network and security analysis tools. Extensive experience with intrusion detection and prevention – host and network, active and passive. Experience running penetration testing and vulnerability scanning (Metasploit, Nessus, etc.). Experience with deployment of policies and security controls within cloud-based platforms (Azure, 0365, etc. …). Experience with configuring and managing SEIM solutions (Splunk, etc. …). Experience with deploying, configuring, and securing virtualized environments, and services running in same. Experience with backup technologies (Veeam, etc. …). Experience with Network-available storage / Storage Area Network security. Experience with federated access control (i.e. Shibboleth, Active Directory Federation Services (ADFS) or similar services. Expert understanding of client and server application deployment and support. Strong understanding of client and server activity tracking. Experience in platform migration and deployment of enterprise-grade SaSS platforms. Experience in configuring and deploying endpoint protection platforms. Broad knowledge of industry innovations and state-of-the-art technology in both computing and networking arenas, and in-depth knowledge of information security.

Skills:

Excellent communication, instruction and presentation skills. Able to describe a variety of complex technical concepts or policies to users and senior leadership at all technical experience levels and to deliver security awareness and education content to faculty, staff and graduate students.

Expert level knowledge of Windows and a variety of Unix-like operating systems (Linux, OpenBSD, OS X), at both server and client level. Comprehensive knowledge of TCP/IP networking and client-server architecture and protocols. Strong understanding of network configuration, hardware and next-gen firewall/IPS technologies (Cisco ASA, Palo Alto, etc. …)

Expert level understanding of the following access control technologies – LDAP, Kerberos, Azure and Active Directory. Expert knowledge of Virtual Private Networks (VPNs). Expert knowledge of Encryption technologies at network, file and file-system levels. Strong understanding of cryptographic certificates and the operation of certificate authorities.

Other:

Ability to work under pressure of high volume and expectations, while meeting multiple deadlines for multiple projects; strong service orientation coupled with ability to recognize and assess the operational significance of a problem, control/mitigate the risk and set priorities accordingly. Strong ability and willingness to work effectively as a team leader and team member; must be able to collaborate and cooperate with team members, project sponsors, other stakeholders. Ability to supervise team members of varying levels and skill sets including Professional/Managerial as well as staff. Must be able to deal calmly and effectively with a variety of people. Demonstrated ability to exercise sound judgment, tact and diplomacy at all times. Ability to effectively navigate a professional and political climate including assessing the requirement to escalate an issue to more senior levels of management or resources or bodies outside the Faculty; ability to maintain a high level of confidentiality.

Closing Date: 05/27/2022,11:59PM ET
Employee Group: Salaried
Appointment Type: Budget - Continuing
Schedule: Full-Time
Pay Scale Group & Hiring Zone: PM 4 -- Hiring Zone: $93,345 - $108,904 -- Broadband Salary Range: $93,345 - $155,575
Job Category: Information Technology (IT)

.buttontext00b26598368a4abe a{ border: 1px solid transparent; } .buttontext00b26598368a4abe a:focus{ border: 1px dashed #25355a !important; outline: none !important; }

All qualified candidates are encouraged to apply; however, Canadians and permanent residents will be given priority.

Diversity Statement

The University of Toronto is strongly committed to diversity within its community and especially welcomes applications from racialized persons / persons of colour, women, Indigenous / Aboriginal People of North America, persons with disabilities, LGBTQ2S+ persons, and others who may contribute to the further diversification of ideas.

As part of your application, you will be asked to complete a brief Diversity Survey. This survey is voluntary. Any information directly related to you is confidential and cannot be accessed by search committees or human resources staff. Results will be aggregated for institutional planning purposes. For more information, please see http://uoft.me/UP.

Accessibility Statement

The University strives to be an equitable and inclusive community, and proactively seeks to increase diversity among its community members. Our values regarding equity and diversity are linked with our unwavering commitment to excellence in the pursuit of our academic mission.

The University is committed to the principles of the Accessibility for Ontarians with Disabilities Act (AODA). As such, we strive to make our recruitment, assessment and selection processes as accessible as possible and provide accommodations as required for applicants with disabilities.

If you require any accommodations at any point during the application and hiring process, please contact uoft.careers@utoronto.ca.

Job Segment: Information Systems, Information Technology, IT Manager, Cloud, Technology, Security