Senior Cybersecurity Program Manager

Accountabilities:

• Own and manage the integrated cybersecurity program plan, including governance routines, milestones, dependencies, risks, and executive reporting for Protected B, FedRAMP Moderate, and DoD IL4 initiatives.

• Serve as a senior program liaison across cybersecurity, quality and risk management, cloud operations, engineering, product, legal, sales, customer success, external assessors, government sponsors, and authorizing organizations.

• Establish and maintain clear RACI assignments, control-owner responsibilities, backup coverage, decision logs, risk acceptance records, and escalation processes.

• Translate regulatory, authorization, contractual, and customer requirements into actionable plans, assigned responsibilities, and measurable operational outcomes.

• Lead cybersecurity program management for existing Protected B services and coordinate the development, readiness, and operationalization of new Protected B solutions.

• Coordinate alignment with Government of Canada security expectations, including ITSG-33 risk management practices, applicable cloud security controls, assessment and authorization activities, and continuous monitoring.

• Support Canadian security responsibilities through government and customer communications, evidence coordination, control ownership, personnel and access requirements, security documentation, and assessment activities.

• Coordinate data-handling, access, data residency, subcontractor, incident management, and shared-responsibility requirements for Protected B services.

• Coordinate FedRAMP Moderate authorization maintenance, annual assessments, control implementation reviews, evidence collection, assessor interviews, continuous monitoring deliverables, POA&M updates, significant-change activities, and customer assurance requests.

• Maintain oversight of FedRAMP authorization documentation, including the authorization boundary, System Security Plan (SSP), control implementation statements, policies, procedures, inventories, diagrams, customer responsibility documentation, and supporting evidence.

• Ensure findings, risks, and compliance obligations have accountable owners, are tracked through resolution, and are escalated when authorization commitments are at risk.

• Lead program coordination for the DoD IL4 GovCloud environment, including DISA and mission-owner engagements, authorization maintenance, eMASS package coordination, annual third-party assessment organization (3PAO) assessments, continuous monitoring, and customer onboarding readiness.

• Coordinate responses to DISA requests, corrective action plans, authorization conditions or restrictions, follow-up questions, evidence requests, and remediation commitments, maintaining complete records of decisions, submissions, approvals, and deadlines.

• Oversee vulnerability governance across operating systems, containers, repositories, base images, applications, and infrastructure. Maintain assigned owners, remediation plans, recurring dashboards, POA&M traceability, deviation and risk acceptance workflows, and supporting evidence.

• Ensure vulnerability reporting clearly communicates out-of-SLA issues, external or customer-facing exposure, authentication and authorization impacts, remediation progress, and residual risk.

• Coordinate GovCloud audit readiness, including control-owner assignments, SSP and IL4 addendum reviews, evidence handling, interview preparation, system demonstrations, CUI-aware screen sharing, assessor follow-ups, and final evidence submissions.

• Maintain integrated risk registers, corrective action trackers, audit plans, control-owner matrices, compliance dashboards, and executive reports.

• Establish governance forums with clear decisions, accountable owners, deadlines, and escalation criteria across security, cloud operations, engineering, and business teams.

• Drive root-cause analysis and sustainable corrective actions for missed assessments, delayed remediation, evidence gaps, unclear ownership, reduced operational capacity, and communication issues.

• Deliver concise, fact-based communications to executives, customers, assessors, and government representatives while protecting Controlled Unclassified Information (CUI), Protected B information, security-sensitive data, and authorization documentation.

Requirements:

• Bachelor's degree in Cybersecurity, Information Technology, Computer Science, Risk Management, Business, or a related field, or equivalent relevant professional experience.

• At least 7 years of experience in cybersecurity, compliance, risk management, auditing, cloud security, or public sector program management, including leadership of complex cross-functional programs.

• Demonstrated experience supporting a cloud service provider or SaaS organization operating in regulated public sector environments.

• Working knowledge of FedRAMP Moderate, NIST SP 800-53/53A, System Security Plans (SSPs), Security Assessment Plans (SAPs), Security Assessment Reports (SARs), Plans of Action and Milestones (POA&Ms), continuous monitoring, annual assessments, and 3PAO engagements.

• Familiarity with U.S. Department of Defense cloud authorization concepts, IL4, DISA authorization processes, eMASS, Security Technical Implementation Guides (STIGs), CUI handling, and authorizing official or mission-owner engagements.

• Experience managing vulnerability remediation programs, SLA monitoring, exception and deviation requests, risk acceptance, corrective action plans, evidence validation, and executive escalation.

• Knowledge of Government of Canada Protected B security expectations, ITSG-33, cloud security controls, shared-responsibility models, and security assessment and authorization practices.

• Experience coordinating external audits, control-owner interviews, system demonstrations, evidence collection, remediation tracking, and government inquiries.

• Strong program management, organizational, and stakeholder coordination skills, with the ability to manage complex activities across multiple teams and regulatory environments.

• Clear and effective communication skills, including the ability to present risk, compliance, and remediation status to executive, customer, assessor, and government audiences.

• Ability to meet the personnel screening, residency, citizenship, background-check, and access eligibility requirements applicable to assigned Canadian and U.S. public sector environments and contracts.

• Must be a Canadian citizen and physically located in Canada.

• Must be eligible to obtain and maintain the Government of Canada security screening required for the role, including at minimum Reliability Status, through Public Services and Procurement Canada’s Contract Security Program (PSPC CSP).

• Must be eligible for appointment as the organization's Company Security Officer (CSO) and maintain the security screening required for its organizational security clearance.

• Must be able to satisfy additional Government of Canada personnel security requirements applicable to federal contracts, including eligibility for Secret security clearance where contractually required.

• Hands-on experience supporting both Government of Canada Protected B and U.S. federal or Department of Defense cloud programs.

• Experience working directly with Government of Canada departments, DISA, federal agency authorizing officials, mission owners, 3PAOs, or independent security assessors.

• Experience with AWS GovCloud, vulnerability scanning, Security Information and Event Management (SIEM), ticketing systems, Governance, Risk and Compliance (GRC) platforms, and evidence management tools.

• Relevant professional certifications such as PMP, PgMP, CISSP, CISM, CISA, CRISC, CCSP, CGEIT, or equivalent credentials.

Benefits:

• Base salary range of CAD 111,500–178,400 for a full-time position.

• Potential annual bonuses and short-term or program-specific awards, depending on the role.

• Comprehensive benefits package; specific coverage details are not listed in the source.

• Flexible remote work arrangement within Canada.

• Compensation based on relevant factors such as education, training, professional experience, certifications, location, business needs, and market conditions.

• An environment that emphasizes equitable pay, market-based compensation, and skills-based evaluation.