Manager, Technology Risk Management, Information & Corporate Security (12 Month Contract)

CPP Investments | Investissements RPC•Toronto, ON

5d•Onsite

About The Position

Joining CPP Investments means joining one of the world’s most admired and respected institutional investors to drive a single mandate: to deliver strong, sustainable returns for generations of Canadians. With a long-term horizon and global reach, we deploy capital at scale across public and private markets. Our size, stability, and disciplined investment philosophy allow us to pursue complex opportunities and build enduring partnerships worldwide. For our people, this means meaningful work with tangible impact, real opportunity, and collaboration with exceptional colleagues who value partnership and performance. Here, you’ll contribute to outcomes that matter alongside team members committed to excellence and shared success. The Technology & Operations department enables CPP Investments' global investment platform by delivering secure, resilient, and innovative technology capabilities that support our long-term investment mandate. The department partners across the organization to manage technology risk while enabling business performance through effective governance, security, and operational excellence. The Cyber & Technology Risk Management team provides first line oversight of technology and information security controls by embedding risk management practices into day-to-day operations. The team partners closely with technology stakeholders to strengthen the control environment through consistent, scalable, and risk-based control testing practices.

Requirements

Undergraduate degree in Computer Science, Information Security, Engineering, Risk Management, Business, or a related discipline.
6–8 years of progressive experience in Technology Risk, IT Audit, Information Security, Internal Controls, or a related discipline within a complex organization.
Demonstrated experience executing Technology and Information Security control testing, including evidence inspection, sampling methodologies, and re-performance.
Strong understanding of technology risk and control frameworks including NIST CSF, NIST 800-53, ISO 27001, COBIT, COSO, and modern technology environments such as cloud platforms and DevSecOps.
Experience using automation, analytics, scripting, and GRC platforms (such as ServiceNow) to enhance control testing and monitoring.
Excellent analytical, communication, stakeholder management, and problem-solving skills, with the ability to translate technical findings into clear business risk insights.

Nice To Haves

Professional certification such as CISA, CISM, CRISC, CISSP, or an equivalent designation is considered an asset.

Responsibilities

Execute end-to-end Technology and Information Security control testing, including planning, walkthroughs, evidence review, sampling, re-performance, and documentation.
Assess the design and operating effectiveness of technology and security controls using a risk-based approach aligned to applicable standards.
Develop and maintain control documentation, testing procedures, evidence requirements, and centralized control libraries to support consistent testing practices.
Identify control deficiencies, determine root causes, and partner with control owners to develop practical and sustainable remediation plans.
Track remediation activities, perform validation testing, and support audit readiness through coordination with second line risk and Internal Audit teams.
Leverage data analytics, automation, and GRC tools to improve testing efficiency, evidence collection, and continuous control monitoring.
Contribute to the ongoing enhancement of first line control testing methodologies, documentation standards, and quality assurance practices.