Cyber Security Manager

Snowstorm Technologies•Vancouver, BC

8d•CA$125,000•Onsite

About The Position

Snowstorm Technologies is looking for a Cyber Security Manager to own and advance our approach to protecting our platforms, cloud environment, and the data our customers trust us with. This is a hands-on leadership role: part architect, part operator, part advisor to the executive team. You will set the direction for our security and compliance programs and stay close enough to the technology to make sound calls under pressure. We build travel technology that real businesses depend on, so security is not a checkbox here. You will work shoulder to shoulder with engineering, cloud operations, product, and QA to keep our security posture strong as the business continues to move. If you enjoy reducing real risk, simplifying messy problems, and being the person leadership turns to when something matters, this role is for you. Snowstorm Technologies is a global travel technology company powering innovative booking, loyalty, rewards, and travel solutions for some of the world’s leading brands. Our platform connects customers to hotels, flights, cruises, activities, and experiences through cutting-edge technology and industry-leading partnerships.

Requirements

At least 8 years in cybersecurity, with 3 or more in a leadership or management role.
Proven track record securing Microsoft Azure environments and enterprise SaaS production systems.
Hands-on experience leading incident response, vulnerability management, audits, and compliance programs.
Strong, practical knowledge across most of the following: Microsoft Azure security, Entra ID, the Defender suite, Sentinel, App Services, and Key Vault.
Database security for Microsoft SQL Server, MongoDB, and Redis.
Web application and API security, OAuth 2.0 and OpenID Connect, and identity and access management.
DevSecOps, vulnerability management, security architecture, and network security.
Incident response, disaster recovery, SIEM platforms, and Datadog.
Bachelor’s degree in cybersecurity, information security, computer science, engineering, IT, or a related field.
You communicate clearly with both engineers and executives, and you can translate risk into decisions.
You are calm under pressure, pragmatic about trade-offs, and biased toward fixing the real problem.
You lead people and vendors well, and you keep improving the things you own.

Nice To Haves

A master’s degree is a plus.
One or more of CISSP, CISM, CCSP, Microsoft Certified: Azure Security Engineer Associate, or Microsoft Certified: Cybersecurity Architect Expert is highly desirable.
Equivalent experience is welcome in place of certifications.

Responsibilities

Set the security strategy, roadmap, and the policies and controls that back it up.
Run risk assessments and vulnerability reviews, and turn the findings into action.
Give leadership a clear, honest read on where the risks are and what to do about them.
Build security into how the company works day to day, not as an afterthought.
Lead detection, investigation, containment, and remediation when incidents happen.
Drive root cause analysis and make sure corrective actions actually stick.
Keep incident response, disaster recovery, and business continuity plans current and tested through tabletop exercises and simulations.
Run the vulnerability management program from discovery through fix.
Secure our Microsoft Azure environment across App Services, virtual machines, AKS, Key Vault, Storage, networking, Front Door, Application Gateway, Defender for Cloud, and Sentinel.
Manage identity and access through Microsoft Entra ID, with MFA, privileged access management, and Zero Trust as the baseline.
Review cloud architectures and configurations against best practices before they become problems.
Embed security into the development lifecycle and set secure coding standards the team can live with.
Review application architectures, APIs, and third-party integrations for weaknesses.
Own vulnerability scanning, penetration testing, SAST, DAST, and dependency reviews, with OWASP as the reference point.
Protect our Microsoft SQL Server, MongoDB, and Redis environments through access controls, encryption, auditing, monitoring, backup, and recovery.
Set data classification, retention, and protection standards, and support our privacy obligations.
Run our compliance programs across SOC 2 Type II, ISO 27001, PCI DSS, the NIST Cybersecurity Framework, CIS Controls, GDPR, and PIPEDA.
Manage external audits and internal assessments end-to-end, including evidence and remediation.
Be the point person for customer security reviews and questionnaires.
Run our monitoring stack, including Microsoft Sentinel, Microsoft Defender, and Datadog.
Watch for threats, investigate what matters, and keep stakeholders informed with clear reporting.
Keep improving detection and response as the environment evolves.
Review the security of vendors, partners, and service providers before and during the relationship.
Set security requirements in contracts and integrations, and hold partners to them.
Build security awareness across the company, including phishing simulations and training.
Mentor security staff, consultants, and managed service providers, and manage security projects and budgets.
Partner closely with engineering, infrastructure, cloud operations, and the wider business.