Senior Manager, Information Security Risk

Salary: $85,500 - 185,000 per year Requirements: 7+ years of relevant experience in cybersecurity, technology, technology risk, operational risk, information security, audit, or a related discipline. Postsecondary degree in Computer Science, Information Technology, Engineering, Cybersecurity, Business Administration, or a related field, or an equivalent combination of education and experience. In-depth knowledge of cybersecurity and technology risk management practices, governance frameworks, risk appetite, control environments, issue management, and remediation governance. Demonstrated technical expertise in one or more cybersecurity disciplines, such as security operations, vulnerability management, cloud security, identity and access management, or security architecture, is strongly preferred. Broader technical experience in enterprise architecture, engineering, infrastructure, cloud platforms, or software development will also be considered. Ability to evaluate cybersecurity strategy, technical architectures, threats, vulnerabilities, control designs, and operational practices, and translate them into clear risk and business implications. In-depth knowledge of applicable cybersecurity regulatory requirements and supervisory expectations, including those established by OSFI, the OCC, and the Federal Reserve. Experience supporting regulatory examinations, supervisory engagements, internal or external audits, or responses to regulatory findings is preferred. Strong working knowledge of recognized cybersecurity and technology risk frameworks and guidance, including NIST, ISO, FFIEC, and other applicable industry standards. Strong understanding of independent risk oversight, risk and control assessment, effective challenge, control testing or validation, risk acceptance, issue management, and remediation governance. Experience leading or contributing to thematic reviews, independent assessments, capability assessments, or other significant risk-based oversight activities. Ability to provide constructive, credible challenge to senior technical and non-technical stakeholders while maintaining effective working relationships. Strong analytical and problem-solving skills, including the ability to assess complex or ambiguous matters, evaluate incomplete or conflicting information, identify material risk implications, and develop practical recommendations. Strong written and verbal communication skills, including the ability to prepare concise materials and communicate complex technical risk matters to executive, Board-level, governance, audit, and regulatory audiences. Strong influencing, negotiation, advisory, and relationship-management skills, with effectiveness across organizational, functional, and jurisdictional boundaries. Ability to identify emerging technologies, threats, regulatory developments, and industry trends and assess their potential implications for the organization. Ability to manage ambiguity, balance competing considerations, and exercise sound independent judgment in a rapidly evolving technology, threat, and regulatory environment. Strong collaboration and leadership skills, including the ability to lead significant oversight initiatives and deliver results through cross-functional engagement. Strong capability in data-informed analysis, risk aggregation, trend identification, risk reporting, and decision support. Relevant cybersecurity or risk certifications, such as CISSP, CISM, CISA, GIAC, or CRISC, are preferred. Responsibilities: Serve as a senior risk advisor, providing independent oversight, credible challenge, and actionable advice on cybersecurity and related technology risks, controls, strategies, and risk management practices. Develop and communicate an independent view of cybersecurity risk across assigned portfolios, including material initiatives, emerging risks, control weaknesses, risk concentrations, and heightened exposures. Advise senior leaders on business decisions, technology transformation, emerging technologies, third-party dependencies, and new capabilities with significant cybersecurity implications. Evaluate cybersecurity governance frameworks, policies, standards, methodologies, controls, and risk management practices, and recommend proportionate improvements. Lead risk-based oversight, including independent risk assessments, thematic and capability reviews, governance activities, and targeted evaluations of material or emerging risks. Challenge significant cybersecurity issues, incidents, risk acceptances, control deficiencies, and remediation plans; advise on escalation when risk levels or management responses do not meet established expectations. Monitor and analyze risk appetite measures, indicators, control performance, issues, incidents, external threats, industry developments, and regulatory expectations to identify adverse trends and exposure changes. Turn complex cybersecurity and technical matters into concise, decision-useful reporting, analysis, and recommendations for senior management, governance committees, Board-level forums, auditors, regulators, and other stakeholders. Act as a subject-matter expert and primary risk partner for assigned cybersecurity areas, using technical credibility and sound judgment to influence risk decisions. Represent the second line during regulatory examinations, supervisory engagements, audits, governance forums, and senior stakeholder discussions. Build trusted relationships across Cybersecurity, Technology, business lines, and risk and control functions while maintaining second-line independence and objectivity. Lead or contribute to cross-functional initiatives that strengthen cybersecurity risk governance, assessment, monitoring, reporting, and organizational risk awareness. Promote consistent, transparent, data-informed risk practices and help advance the risk management framework and oversight capabilities. Technologies: Cloud Support Security More: We are hiring a Senior Manager, Cyber Risk Oversight and Governance within our Technology and Operations risk area, part of Operational and Non-Financial Risk (ONFR), our independent second line of defense. Based at 100 King Street West, this role provides independent oversight and constructive challenge on cybersecurity and related technology risks, advising senior leaders and working across Cybersecurity, Technology, business lines, and risk and control functions. Our salary range is $85,500–$185,000, with compensation varying according to factors such as location, skills, experience, education, and qualifications. Our total compensation may include incentives, discretionary bonuses, health insurance, tuition reimbursement, accident and life insurance, and retirement savings plans. At BMO, our shared purpose is to boldly grow the good in business and life by creating positive change for customers, communities, and our people, working together to support economic growth around the world. last updated 40 week of 2026