Cyber Security Advisor

Address:

As a Cyber Security Advisor, you will serve as a trusted partner to business and technology teams, helping them navigate cyber security requirements throughout the lifecycle of technology initiatives, application changes, infrastructure updates, data movement activities, and production deployments.

Acting as a key liaison between business stakeholders, application teams, infrastructure teams, and Cyber Security Subject Matter Experts (SMEs), you will help ensure that security requirements are understood, addressed, and incorporated into delivery activities.

This role is focused on security advisory, coordination, governance, and stakeholder engagement rather than hands-on security operations, risk assessments/audits or engineering activities. You will provide guidance, coordinate reviews, validate supporting documentation and evidence, facilitate approvals, and connect stakeholders with the appropriate security experts when specialized expertise is required.

Success in this role comes from building strong relationships, effectively communicating security requirements, and helping teams navigate security processes while enabling successful business and technology outcomes.

Key/CORE Responsibilities:

• Review application architectures and development patterns to identify security risks and recommend improvements. 

• Identify security risks across custom-built, SaaS, and third-party applications, and work with application owners to define practical remediation plans. 

• Support cybersecurity operations by recommending security controls aligned with BMO policies and standards. 

• Review the application of security products and technologies to ensure they protect the organization’s systems and information and support its objectives. 

• Build strong relationships with practice stakeholders and encourage accountability for ongoing cybersecurity improvements. 

• Review authentication, authorization, data handling, and integration patterns to ensure secure-by-design implementations. 

 CORE Technical Skills & Experience:

• 3-5 years of experience reviewing technology, application, infrastructure, or production changes against established cyber security policies, standards, and control requirements.
• This includes knowledge of Cloud security, DevSec Ops, and Zero Trust. In addition, knowledge of security information and event management (SIEM) and encryption. In addition, strong knowledge of Firewalls, intrusion detection and prevention systems, data loss prevention solutions, endpoint protection, log aggregation, and other leading-edge security technologies used to protect the company against cyber threats are important.
• 3-5 years of experience validating security documentation, evidence, and control requirements as part of a security review, governance, audit, compliance, or approval process.
• 3-5 experience coordinating initiatives, tracking action items, monitoring progress, and supporting the implementation of security improvements. 
• 3-5 years of experience providing cyber security guidance and recommendations to business and technology stakeholders.
• Working knowledge of industry-recognized cyber security frameworks and standards, including NIST Cybersecurity Framework (CSF) and ISO 27001/27002.
• Demonstrated ability to analyze security requirements and translate them into practical guidance for project, application, and technology teams.
• Strong communication, relationship-building, organizational, and problem-solving skills

 What Will Help You Succeed:

• Ability to build trusted relationships and influence stakeholders across business and technology teams.
• Strong problem-solving skills and sound judgment when evaluating security requirements and recommendations.
• Ability to balance security requirements with business objectives and operational needs.
• Comfortable navigating complex environments and coordinating with multiple stakeholders to drive outcomes.
• Ability to handle competing and complex priorities

Additional Information:

• Provides information security consulting services for BMO overall and businesses/groups.
• Liaises with stakeholders to understand problems and opportunities and enables BMO to meet its goals by understanding business vision, objectives and KPIs.
• Leads the development of information security strategy by understanding business processes, policies, information and information systems.
• Builds exceptional relationships with internal and external stakeholders.
• Ensures that requirements and solutions align to a real business need, are approved by all relevant stakeholders, and meets essential information security standards.
• Provides thought leadership, promotes new processes and methodologies and emerging technologies, with the flexibility to align to the unique requirements of the business/group and deliverables.
• Acts as a trusted advisor to assigned business/group.
• Assists in the development of strategic plans.
• Understands and can explain to others the core processes, risks and mitigation techniques for designated areas.
• Supports the execution of strategic initiatives in collaboration with internal and external stakeholders.
• Helps determine business priorities and best sequence for execution of business/group strategy.
• Breaks down strategic problems, and analyses data and information to provide insights and recommendations.
• Acts as the day to day contact for vendors; supports the implementation, maintenance, and sustainment of vendor solutions.
• Understands the strategy, plans, activities and needs of all stakeholders and translates those business needs into solutions and makes recommendations.
• Provides advice, counsel and support on information security matters and recommends solutions to assigned business/group leaders on principles, frameworks, programs, approaches, trends, legislation and regulatory requirements including interpretation of policy and identification and management of risk.
• Builds credibility and influences/negotiates effectively to drive business performance through development and delivery of information security solutions.
• Tracks metrics and milestones, providing recommendations for resolution and escalating as appropriate when issues arise.
• Facilitates discussions and follows a disciplined approach to plan, elicit, analyse, document, communicate and manage initiatives and issues with stakeholders by applying a variety of elicitation techniques to probe, challenge and understand associated risks.
• Promotes process improvements and methodologies; keeps emerging information security issues and trends in mind and ensures standards are followed.
• Creates professional presentations and deliver them in a meaningful concise way.
• Assesses information security impact to a project’s benefits and risks when scope changes.
• Develops and champions information security best practices, including staying abreast of industry information security and business trends through benchmarking and/or participation in professional associations.
• Gathers, examines and interprets data and information to extract meaningful insights, answer business questions and provide actionable recommendations.
• Assists with continuous improvement activities and root cause analysis with the goal of strengthening information security capabilities.
• Ensures consistent, high quality practices/work and the achievement of business results in alignment with business/group strategies and with productivity goals.
• Focus is primarily on business/group within BMO; may have broader, enterprise-wide focus.
• Provides specialized consulting, analytical and technical support.
• Exercises judgment to identify, diagnose, and solve problems within given rules.
• Works independently and regularly handles non-routine situations.
• Broader work or accountabilities may be assigned as needed.
• Take measured risks while protecting the bank by applying our Risk Management Framework in the execution of your role, in line with our Risk Culture and within our approved Risk Appetite, making sound and risk informed decisions that align to business strategy, protect assets, and adhere to applicable policy documents (Frameworks, Policies, Standards, Procedures and Supporting documents), laws and regulations.Qualifications:
• Typically between 4 - 7 years of relevant experience and a post-secondary degree in Information Security, Computer Science, Engineering, and/or Information Systems or a related field of study or an equivalent combination of education and experience.
• Preference for candidates who have at least one certification in a related field, with strong preference for Information security certifications from a well-recognized institution (e.g. (ISC)2, ISACA, SANS).
• Understanding of industry standards and frameworks e.g. NIST Cyber Security Framework (CSF), ISO 27001 and 27002, Payment Card Industry (PCI) Data Security Standard (DSS), etc. - In-depth.
• Experience in information security concepts and methodology.
• Knowledge of business analysis, project delivery practices and standards across the project lifecycle - In-depth.
• Knowledge of information security processes, procedures and controls - In-depth.
• Understanding of and problem solving ability for information security issues within their business group - Working.
• Understanding of information security risk and regulatory requirements - Working.
• Deep knowledge and technical proficiency gained through extensive education and business experience.
• Verbal & written communication skills - In-depth.
• Collaboration & team skills - In-depth.
• Analytical and problem solving skills - In-depth.
• Influence skills - In-depth.
• Data driven decision making - In-depth.

The above represents BMO Financial Group’s pay range and type.

Salaries will vary based on factors such as location, skills, experience, education, and qualifications for the role, and may include a commission structure. Salaries for part-time roles will be pro-rated based on number of hours regularly worked. For commission roles, the salary listed above represents BMO Financial Group’s expected target for the first year in this position.

BMO Financial Group’s total compensation package will vary based on the pay type of the position and may include performance-based incentives, discretionary bonuses, as well as other perks and rewards. BMO also offers health insurance, tuition reimbursement, accident and life insurance, and retirement savings plans. To view more details of our benefits, please visit: https://jobs.bmo.com/global/en/Total-Rewards

About Us

At BMO we are driven by a shared Purpose: Boldly Grow the Good in business and life. It calls on us to create lasting, positive change for our customers, our communities and our people. By working together, innovating and pushing boundaries, we transform lives and businesses, and power economic growth around the world.

As a member of the BMO team you are valued, respected and heard, and you have more ways to grow and make an impact. We strive to help you make an impact from day one – for yourself and our customers. We’ll support you with the tools and resources you need to reach new milestones, as you help our customers reach theirs. From in-depth training and coaching, to manager support and network-building opportunities, we’ll help you gain valuable experience, and broaden your skillset.

To find out more visit us at https://jobs.bmo.com/ca/en.

BMO is committed to an inclusive, equitable and accessible workplace. By learning from each other’s differences, we gain strength through our people and our perspectives. Accommodations are available on request for candidates taking part in all aspects of the selection process. To request accommodation, please contact your recruiter.

Note to Recruiters: BMO does not accept unsolicited resumes from any source other than directly from a candidate. Any unsolicited resumes sent to BMO, directly or indirectly, will be considered BMO property. BMO will not pay a fee for any placement resulting from the receipt of an unsolicited resume. A recruiting agency must first have a valid, written and fully executed agency agreement contract for service to submit resumes.