Information Security Strategy and Risk Lead

• FISPAN is hiring a Lead, Information Security Strategy and Risk to help ensure security decisions, control designs, and technical changes are reviewed early and implemented with the right level of rigor
• This role focuses on practical security architecture, design assurance, and risk reduction across product, engineering, infrastructure, and operational change
• You will partner closely with Engineering, Infrastructure, Product, GRC & Legal to review material technical decisions, assess security controls, and help teams move quickly without introducing avoidable risk
• You will also lead key parts of FISPAN’s vulnerability management and penetration testing program, translating technical findings into clear remediation priorities and durable security improvements
• Security Design & Risk Review
• Lead security and risk reviews for material technology, infrastructure, integration, product, and operational changes
• Define security principles, control expectations, and risk guardrails across cloud, SaaS, data flows, identity, privileged access, and production environments
• Provide security-by-design guidance for new systems, internet-facing services, AI capabilities, shared platforms, and sensitive data integrations
• Support risk assessments, threat modeling, control reviews, and documented security decisions for significant initiatives
• Vulnerability Management & Security Testing
• Own the vulnerability management strategy and governance process across applications, infrastructure, cloud services, and shared platforms
• Define risk-based severity, prioritization, remediation expectations, escalation, and exception handling
• Identify recurring vulnerability patterns and drive lasting control improvements and measurable risk reduction
• Provide oversight of high-severity vulnerabilities, external exposure, and emerging threats
• Security Strategy, Risk & Oversight
• Develop and maintain security strategy and priorities aligned with business objectives, regulatory obligations, and bank partner expectations
• Identify material and emerging risks, recurring control weaknesses, and areas requiring broader security investment
• Translate technical risks into clear business impact, priorities, and recommendations for leadership
• Contribute to security governance, risk reporting, roadmap planning, and oversight of material exceptions and risk acceptances
• Partner with Product, Engineering, Compliance, Legal, and Operations to embed security and risk considerations into key decisions

Benefits

• 4-Week Vacation
• Health & Wellness Coverage
• 100% Parental Leave Top-Up
• Downtown Vancouver Offices & Amenities including fitness centre
• Daily Coffee Runs & Weekly Team Lunches
• MacBook / Apple equipment

• Experience leading or materially contributing to vulnerability management and penetration testing programs
• 7+ years in security architecture, cloud security, application security, security assurance, or technical risk roles with strong technical collaboration
• Demonstrated experience reviewing architecture and implementation decisions in SaaS or cloud-native environments
• Ability to assess material risk, identify control gaps, and drive practical remediation
• Strong written communication skills, including the ability to produce clear security recommendations, design feedback, and executive-facing summaries
• Strong understanding of security controls across IAM, cloud infrastructure, network security, logging/monitoring, vulnerability management, and production access
• Strong collaboration and teamwork skills with the ability to work effectively across Engineering, Infrastructure, Product, Legal/GRC, and Security
• Experience in FinTech, banking, embedded finance, or regulated SaaS environments
• Experience reviewing shared infrastructure patterns, workflow automation platforms, and operational tooling
• Familiarity with AWS, Kubernetes/EKS, cloud networking, and production change patterns
• Familiarity with privacy and regulatory expectations relevant to SaaS platforms serving financial institutions