Lead, Cyber Resilience & Offensive Security

About the role

EQ Bank is looking for a Lead, Cyber Resilience & Offensive Security in Toronto. The role designs, plans and executes the bank's Cyber Resilience Testing and offensive security program, commonly called red team exercises, and develops and manages the processes that set continuous red team and infrastructure penetration test objectives throughout the year while planning threat simulation activities. It also facilitates the communication and presentation of technical cyber control effectiveness to key stakeholders.

Key responsibilities

• Design and execute the bank's Cyber Resilience Testing program, including red team exercises and cyber threat simulations.
• Provide input to the effectiveness testing of EQ Bank's enterprise cyber security controls and to cyber roadmap prioritization.
• Drive cross-functional collaboration to achieve the objectives of the programs under its purview.
• Maintain the standards, procedures and guidelines for the domains under its purview.
• Develop and manage measures ensuring effective monitoring, control adequacy and compliance for those areas.
• Develop and manage ways to measure the performance of control processes and technologies.
• Provide technical guidance to the team and subject-matter advice to stakeholders.

Required profile

• Diploma or university degree in computer science (or a related course), or industry-recognized certifications such as CISSP.
• At least 7 years of technical IT experience, with 3-5 years in offensive security roles.
• Strong engineering and automation experience; prior hands-on security automation experience is desired.
• Ability to build strong working relationships with cross-functional teams and stakeholders, and strong analytical, problem-solving and strategic thinking skills.
• People and team management abilities, and ownership and accountability.

Required skills

• Strong knowledge of cyber controls testing frameworks such as the MITRE framework.
• Preferred certifications: OSCP, OSCE, GPEN, GXPN, CEH, CISSP, CISM.