Global Head of Cyber Security

Innocap • Montreal, QC

21h • Hybrid

About The Position

As Innocap’s senior cybersecurity leader, the Global Head of Cybersecurity defines and executes the firm’s global cybersecurity strategy and operating model. Reporting to the Chief Technology Officer, the role safeguards the confidentiality, integrity, availability and resilience of Innocap’s information assets, technology platforms and critical business services while enabling growth, innovation and client commitments.

The role operates at an enterprise level, advising executive leadership on cyber risk, establishing the firm’s security posture and risk-based priorities, and providing independent challenge and escalation on material cybersecurity matters. The Global Head leads a global team of employees, consultants and security partners and works closely with Technology, Risk, Compliance, Legal, Privacy, Internal Audit and business leaders to embed security by design across the organization.

Responsibilities include owning and evolving the global cybersecurity strategy, operating model, policies, standards and roadmap; establishing enterprise cyber-risk practices and reporting; setting security architecture principles; leading security operations and incident response; strengthening cyber resilience; overseeing identity, access and data-protection strategies; managing cybersecurity aspects of third-party risk; and building the global cybersecurity team and partner ecosystem.

Requirements

• University degree or equivalent relevant training in cybersecurity, computer science, information technology, engineering or a related field.
• Typically 15+ years of progressive cybersecurity, technology risk or information security experience, including substantial experience leading a global or multi-region security function in a complex, regulated environment.
• Demonstrated experience operating with a CISO-level mandate, shaping enterprise strategy, advising senior executives and communicating material risk to non-technical decision-makers.
• Deep knowledge of cybersecurity governance, enterprise risk management, security architecture, cloud security, incident response, resilience, threat management, data protection and third-party risk.
• Advanced experience securing Microsoft Azure and Microsoft 365 environments, with a strong understanding of modern identity, zero-trust, application security, DevSecOps and AI-related security risks.
• Practical knowledge of leading frameworks and standards, including NIST CSF, ISO/IEC 27001, CIS Controls and SOC 2.
• Proven success leading and developing global teams and managing SOC capabilities, external service providers, budgets and strategic security investments.
• Exceptional judgment, executive presence and influence, with the ability to balance risk reduction, operational resilience, client expectations and business enablement.
• Excellent written and verbal communication skills in English, with the ability to translate complex technical matters into clear business implications and decisions.

Nice To Haves

• French knowledge is an asset.
• Knowledge of financial markets, alternative investments, asset servicing or the hedge fund industry is a strong asset.
• Relevant certifications such as CISSP, CISM, CRISC, CCSP or equivalent are assets.

Responsibilities

• Own and continuously evolve the global cybersecurity strategy, target operating model, policies, standards and multi-year roadmap, aligned with the firm’s business strategy, risk appetite and frameworks such as SOC 2 and ISO/IEC 27001.
• Establish an enterprise approach to identifying, assessing, prioritizing, treating and accepting cyber risk; maintain visibility into material risks, control gaps, threat exposure and remediation priorities; and integrate cyber risk into enterprise risk management.
• Provide decision-oriented reporting to executive leadership and governance bodies on cyber risk, threat trends, incidents, control effectiveness, regulatory exposure, investment priorities and program performance; promptly escalate material risks and incidents.
• Set security architecture principles and embed security throughout the technology and product lifecycle, including Microsoft Azure, Microsoft 365, identity, networks, applications, data platforms, business intelligence, software development, cloud services and artificial intelligence solutions.
• Lead global security operations, including monitoring, threat intelligence, detection engineering, vulnerability management and incident response; act as executive escalation point for significant events and direct containment, investigation, recovery, root-cause analysis and lessons learned.
• Define cyber crisis management, response and recovery capabilities; conduct exercises and simulations; and partner with Technology and business teams to validate recovery strategies for critical services and data.
• Oversee strategies for identity and access management, privileged access, data protection, encryption, information handling and zero-trust principles, ensuring controls are proportionate to data sensitivity, business criticality and evolving threats.
• Own cybersecurity components of the third-party risk management lifecycle, including due diligence, risk tiering, contractual requirements, ongoing monitoring, issue remediation and incident coordination for critical vendors and cloud service providers.
• Build, develop and retain a high-performing global cybersecurity team and partner ecosystem; define accountabilities, succession and capability plans; oversee budgets and vendors; and drive security awareness, role-based learning and a culture of cyber accountability.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior