Director, IT & Cybersecurity

Azrieli Foundation•Toronto, ON

4d•CA$160,000 - CA$195,000

About The Position

The Azrieli Foundation is one of Canada’s largest philanthropic foundations, supporting initiatives in education, science & healthcare, research and the arts. Through strategic grants and partnerships, we strive to foster innovation, empowerment and drive positive change within these critical sectors in Canada and Israel. Reporting to the CEO, the Director of IT and Cybersecurity is accountable for the Foundation’s complete technology and cybersecurity environment. The Director will provide strategic leadership while remaining hands-on enough to assess, troubleshoot and directly address complex technical matters when required. They will oversee the IT Manager, manage the Foundation’s relationship with its managed service provider, and serve as the primary point of contact for other IT and cybersecurity vendors and contractors. A key initial priority will be to conduct a comprehensive end-to-end assessment of the Foundation’s technology environment, cybersecurity posture, resources, vendors, processes and risks. Based on this assessment, the Director will develop a target operating model and roadmap that clearly defines the people, capabilities, technology, governance and external support required to meet the Foundation’s needs. The Director will serve as the Foundation’s senior technical authority and primary advisor to the executive team on technology operations, cybersecurity risk, infrastructure, business continuity and technology investment.

Requirements

10+ years of progressive experience in information technology, infrastructure, cybersecurity or related areas, including significant experience in a senior leadership or technology management role.
Demonstrated experience leading or overseeing a broad technology environment encompassing infrastructure, networks, cloud services, Microsoft 365, end-user technology and business applications.
Strong practical knowledge of cybersecurity principles and controls, including identity and access management, vulnerability management, endpoint and network security, security monitoring, data protection and third-party risk.
Experience developing or overseeing cybersecurity programs, policies, incident response plans, business continuity and disaster recovery capabilities.
Demonstrated ability to assess complex technology environments, identify risks and capability gaps, and translate findings into practical priorities, roadmaps and investment recommendations.
Experience managing managed service providers, technology vendors and specialized external partners, including establishing service expectations, evaluating performance and determining the appropriate allocation of work between internal and external resources.
Strong technical judgment and sufficient hands-on technical expertise to independently assess complex issues, challenge vendor recommendations and provide direction during significant technology or cybersecurity incidents.
Experience managing technology budgets, contracts, licensing, lifecycle planning and technology investment decisions.
Strong leadership, communication and stakeholder-management skills, with the ability to communicate technology and cybersecurity risks clearly to executives and non-technical audiences.
Postsecondary education in information technology, computer science, cybersecurity, engineering or a related discipline, or an equivalent combination of education and relevant professional experience.

Nice To Haves

Relevant professional certifications such as CISSP, CISM, CRISC, CCSP, Microsoft/Azure certifications or comparable credentials are considered an asset.
Experience overseeing physical security systems or vendors, including access control, surveillance, alarms or related services, is considered an asset.

Responsibilities

Conduct a comprehensive assessment of the Foundation’s technology and cybersecurity environment, including infrastructure, systems, vendors, internal capabilities, processes and risks.
Develop a target operating model defining the appropriate allocation of responsibilities among internal employees, the managed service provider and specialized vendors.
Identify capability gaps, resource requirements, technical debt, control weaknesses and material risks.
Develop and maintain a prioritized technology and cybersecurity roadmap.
Establish clear governance, documentation, decision-making and accountability practices.
Advise the COO and executive leadership on technology risks, investments and emerging requirements.
Maintain overall accountability for the availability, reliability, performance and security of the Foundation’s technology environment.
Oversee a hybrid environment that includes on-premises servers, network infrastructure, cloud services, Microsoft 365, SharePoint, end-user devices and specialized applications.
Ensure appropriate monitoring, maintenance, configuration, patching, backup, vulnerability remediation and lifecycle management practices are in place.
Maintain accurate inventories of technology assets, systems, software, licenses, privileged accounts and infrastructure dependencies.
Establish standards for technology configuration, deployment, maintenance and decommissioning.
Provide hands-on technical support, investigation and remediation for complex or sensitive issues when appropriate.
Determine whether work should be completed directly, delegated to the IT Manager or assigned to an external provider.
Ensure technology services are delivered consistently across multiple entities, offices and remote work arrangements.
Establish and oversee a comprehensive cybersecurity program appropriate to the Foundation’s operations, information assets and risk profile.
Assess the Foundation’s cybersecurity posture and identify control gaps and remediation priorities.
Develop and maintain cybersecurity policies, standards, procedures and playbooks.
Oversee identity and access management, including provisioning, role-based access, privileged access, authentication standards, access reviews and timely removal of access.
Ensure appropriate security monitoring, vulnerability management, endpoint protection, email security, network security and data protection controls are maintained.
Coordinate cybersecurity assessments and vulnerability testing as appropriate.
Oversee cybersecurity awareness, phishing simulations and role-specific employee training.
Evaluate cybersecurity risks associated with vendors, systems and applications.
Ensure identified risks are documented, prioritized, communicated and appropriately mitigated or accepted.
Lead the Foundation’s preparation for and response to cybersecurity and significant technology incidents.
Develop and maintain incident response plans, escalation procedures, communications protocols and technical playbooks.
Coordinate internal employees, the managed service provider, cybersecurity vendors, insurers, legal counsel and other external parties during an incident.
Exercise appropriate authority during active incidents to isolate systems, suspend access, restrict connectivity or take other reasonable protective actions.
Ensure incidents are investigated, documented and followed by appropriate remediation and lessons-learned reviews.
Conduct periodic tabletop exercises to assess incident readiness.
Own the technology components of the Foundation’s business continuity and disaster recovery programs.
Identify critical systems, applications, infrastructure, data and operational dependencies.
Establish recovery objectives, backup requirements, redundancy measures and recovery procedures.
Ensure backups are secure, monitored and periodically tested.
Develop and maintain disaster recovery plans and system-specific recovery procedures.
Coordinate continuity planning with operational leaders across the Foundation.
Conduct periodic testing to assess the Foundation’s ability to maintain or restore critical operations.
Serve as the Foundation’s primary point of contact and internal authority for the managed service provider and other IT and cybersecurity vendors.
Define clear roles, responsibilities, service expectations, escalation procedures and performance standards.
Direct, prioritize and evaluate the work performed by external technology partners.
Review vendor recommendations and ensure proposed solutions are secure, appropriate and cost-effective.
Monitor service levels, issue resolution, security practices and contractual performance.
Determine which services should be maintained internally, assigned to the managed service provider or outsourced to a specialized vendor.
Support vendor selection, contract negotiations and renewals.
Ensure critical technical knowledge and administrative access do not reside exclusively with external providers.
Provide leadership, direction and technical oversight to the IT Manager.
Clarify responsibilities and establish appropriate service, support and development expectations.
Assign work based on complexity, risk, business impact and individual capability.
Assess the future structure, skills and resourcing needs of the internal IT function.
Oversee the administration, integration, security and lifecycle management of the Foundation’s core technology platforms.
Evaluate the governance and administrative requirements of Microsoft 365, SharePoint, cloud services and specialized business applications.
Partner with business leaders to assess system needs and identify opportunities to improve technology-enabled processes.
Ensure application ownership, administrative access, system documentation and vendor responsibilities are clearly defined.
Develop and maintain technology and cybersecurity policies, procedures, standards and documentation.
Establish appropriate reporting on technology performance, cybersecurity risk, incidents, assets, vendor performance and remediation activity.
Provide clear and practical updates to the executive team.
Support cyber insurance applications, audits, risk assessments.
Develop and manage the annual IT and cybersecurity budget.
Forecast infrastructure, software, licensing, vendor, staffing and lifecycle replacement costs.
Evaluate technology investments decisions and make recommendations to the executive team.