The Cyber Security Manager, Governance, Risk and Compliance leads Seaspan Shipyards’ cybersecurity governance, risk, compliance and assurance programs. The role is accountable for readiness and ongoing compliance with the Canadian Program for Cyber Security Certification (CPCSC), Cybersecurity Maturity Model Certification (CMMC), GDPR, Canadian privacy requirements and other contractual or regulatory obligations.
This is a working-manager role. The Manager provides direction to cybersecurity staff while remaining hands-on in risk assessments, policies, control documentation, remediation plans, audit evidence and executive reporting. The role also provides security oversight for AI, DevSecOps, cloud services and third parties.
Note: This position qualifies for an optional hybrid work schedule after 90 days of onsite work and onboarding. Employees will be subject to the terms of the Flexible Work Policy Agreement.
What you'll do
Governance, Risk and Compliance
- Lead cybersecurity governance, risk, compliance and assurance programs, including CPCSC and CMMC readiness, certification and continuous compliance.
- Translate contractual, regulatory and privacy obligations into practical business and technology controls.
- Maintain an integrated control framework aligned with CPCSC, ITSP.10.171, CMMC, NIST SP 800-171, NIST CSF, ISO 27001, GDPR and applicable Canadian privacy requirements.
- Maintain policies, risk registers, control documentation, compliance evidence and dashboards; report material risks, overdue actions and decisions required.
- Recommend remediation, compensating controls or formal risk acceptance where requirements cannot be fully met.
Compliance Delivery and Assurance
- Define the scope and boundaries of environments processing sensitive government, defence, personal or regulated information.
- Develop and maintain System Security Plans, Plans of Action and Milestones, control matrices, inventories, data-flow diagrams and audit evidence.
- Coordinate control owners across IT, OT, Contract Security, Legal, Privacy, Procurement and business operations.
- Lead risk and gap assessments, control testing, evidence reviews, audit preparation and remediation tracking.
- Coordinate assessors, auditors, certification bodies, customers and government stakeholders; manage supplier and subcontractor compliance obligations.
- Ensure controls operate effectively and are supported by defensible evidence.
Privacy, AI and Third-party risk
- Partner with Legal and Privacy teams on GDPR, Canadian privacy requirements, privacy impact assessments, data-residency reviews and cross-border transfer assessments.
- Establish cybersecurity risk practices for AI, machine learning, generative AI and automation solutions.
- Assess AI solutions for data exposure, access control, insecure integrations, third-party dependencies, retention and regulatory risk.
- Define security requirements for enterprise AI and assess vendors and cloud services against security, privacy, contractual and compliance requirements.
- Track AI, privacy and third-party risks, exceptions and remediation through the enterprise risk-management process.
DevSecOps and Cloud Security
- Provide security direction for DevSecOps and application-development practices.
- Establish requirements for secure development, source-code management, CI/CD pipelines, secrets management, infrastructure as code and vulnerability remediation.
- Work with technology teams to embed security controls throughout the delivery lifecycle.
- Support cloud-security assessments, architecture and configuration reviews, and compliance monitoring across cloud and hybrid environments.
- Experience with security and compliance controls in Microsoft Azure, Microsoft 365 and AWS is considered an advantage.
People Leadership and Hands-on Delivery
- Set priorities and provide direction, coaching and technical guidance to direct reports and assigned resources.
- Assign accountability for assessments, controls, evidence, policies, remediation and reporting; review deliverables for quality and audit readiness.
- Develop team capability in GRC, CPCSC, CMMC, privacy, AI risk, DevSecOps, cloud security and control testing.
- Personally develop and review policies, risk assessments, control narratives, audit evidence, compliance submissions and executive briefings.
- Facilitate risk workshops, control walk-throughs, gap assessments and evidence reviews; escalate unresolved findings, control failures and resource constraints.
What you'll bring
- Bachelor’s degree in cybersecurity, computer science, information systems, engineering, risk management or a related discipline, or equivalent experience.
- 10 or more years of relevant cybersecurity, GRC, audit, risk, compliance, privacy or technology experience.
- Experience leading security compliance programs in a complex, regulated, government, defence, industrial or critical-infrastructure environment.
- Practical experience with CPCSC, CMMC, NIST SP 800-171, NIST CSF, ISO 27001 or comparable frameworks.
- Experience developing System Security Plans, Plans of Action and Milestones, control matrices, risk registers, policies and audit evidence.
- Working knowledge of GDPR and Canadian privacy requirements, plus experience with certification readiness, audits or regulatory reviews.
- Relevant certification such as CISSP, CISA, CRISC, CISM, CGRC, ISO 27001 Lead Implementer or Lead Auditor, Certified CMMC Professional, or equivalent.
- Direct experience supporting CPCSC or CMMC readiness or certification.
- Experience with AI security, privacy assessments, DevSecOps, application security, cloud security across Microsoft or AWS, GRC platforms, or OT security.
- Strong knowledge of identity and access management, data protection, vulnerability management, logging, incident response, cloud security and third-party risk.
- Demonstrated people leadership, strong business communication and the ability to manage multiple programs while remaining hands-on.
Why you'll love working here
- This is a full-time, permanent position.
- In addition to an annual bonus and pension plan matching, this role provides you a very competitive salary in line with the successful candidate’s experience.
- We also provide the best-in-class health and wellness benefits package for this position, including things such as extended health care (i.e. paramedical services for massage therapy, speech therapy, mental health coverage, physiotherapy, and more), dental care, vision care, life insurance, medical leave coverage, parental leave coverage, childcare benefit partnership, $500 personal spending account, and an Employee Family Assistance Program (EFAP).
- This position qualifies for an optional hybrid work schedule.
- Free on-site gym.
- Parking is included and to assist those that are using transit, we operate a complimentary shuttle bus Monday through Friday with various pick up and drop off points around North Vancouver.
The estimated salary for this position is $143,100 - $174,900. In determining final salary, Seaspan considers many factors including the successful Candidate’s skillset and experience as well as position location and internal equity. The final base salary offer will be at the Company’s sole discretion and presented as part of a competitive total compensation package.
Seaspan Shipyards is one of North America’s most modern shipyards and unique in its ability to provide a complete range of services including new construction, conversion, refit, repair and life-cycle maintenance work for Canada’s Coast Guard and Navy as well as commercial vessels including cruise-ships and deep-sea vessels. Seaspan Shipyards operations include Vancouver Shipyards, Vancouver Drydock and Victoria Shipyards.
To learn more, visit our website: www.seaspan.com
This position may involve defense articles and/or technical data regulated by the U.S. International Traffic in Arms Regulations (“ITAR”) and the U.S. Arms Export Control Act. In compliance with ITAR, the successful candidate will be subject to a security clearance through the Canadian Controlled Goods Program as regulated by the Controlled Goods Regulations and Defense Production Act. The successful candidate will be required to maintain their security clearance throughout their employment in this position.
Seaspan is committed to Employment Equity, supports diversity in the workplace, and encourages applications from all qualified individuals including, women, members of visible minorities, Indigenous persons, and persons with disabilities. If you require any accommodations at any stage of the recruitment process, please reach out to our Talent Acquisition team at recruit@seaspan.com for confidential support. We are committed to providing an inclusive and accessible environment.
Due to the nature of this position, and requirements of the Government of Canada, this position requires the successful candidate to obtain and maintain a Canada Controlled Goods Program approval, Reliability Status (or higher depending on position) security clearance issued by the Government of Canada. All required approvals and clearances must be obtained prior to commencement of employment in any position. The successful candidate will also be required to obtain a satisfactory criminal record check as a precondition to commencement of employment.
