The City of Calgary's Cyber Security Business Unit safeguards information, technology, and operational systems that enable the delivery of services to Calgarians.
As the Team Lead, Cyber Security Exposure Management, you will be accountable for the City's cyber security exposure management program, a foundational capability for managing cyber security risk. The program provides cyber security posture insights across enterprise assets, including data, processes, and IT and OT technology systems, to inform risk-based treatment decisions and strengthen business resilience.
Specifically, you will manage a team of highly skilled professionals to unify and contextualize intelligence pertaining to cyber security exposures, vulnerabilities, threats, and security assurance and testing. In collaboration with Cyber Security leadership peers and City partners, you will provide guidance to mobilize efforts from diverse City business units, technology teams, and external parties through the exposure management lifecycle - from discovery and validation through remediation, exception management, and verification. Primary duties include:
- Provide leadership, coaching, and mentorship to a team of cyber security professionals, establish work priorities, and advance the growth and continuous improvement of the exposure management function and the City's Cyber Security mandate and roadmap.
- Lead the development, implementation, operation, and continuous improvement of the City's cyber security exposure management program and its integration into the broader Cyber Security operating model.
- Build and maintain collaborative and productive relationships with City colleagues, business units, and external partners to support exposure identification, prioritization, treatment, and verification across IT and OT environments.
- Define and operationalize criteria for exposure prioritization and provide recommendations and escalation to Cyber Security leadership and governance forums regarding material exposures, treatment decisions, exceptions, and unresolved vulnerabilities.
- Establish and evolve structures, methodologies, processes, and governance practices that support effective exposure management and enable outcome-based metrics and reporting for coverage, performance, assurance and compliance.
Qualifications - A diploma in Computer Science, Cyber Security, Information Technology, Risk Management, or a related field combined with at least eight (8) years of relevant employment experience; OR
- A degree in Computer Science, Cyber Security, Information Technology, Risk Management, or a related field combined with at least (4) years of relevant employment experience.
- One or more recognized and current cyber security, risk management or architecture certifications, such as CISSP, CCSP, CISA, CISM, CRISC, SABSA, TOGAF or GIAC are required; combinations of education and experience may be considered.
- Demonstrated employment experience at a senior level in cyber security exposure management, vulnerability management, vulnerability and malware analysis, penetration testing / Red Teaming, security assurance, or control validation is required.
- Previous employment experience leading teams would be considered an asset.
- Previous employment experience within cyber security functions in complex, public sector, or highly regulated environments would be considered an asset.
- Success in this position requires:
- Empathy and active listening, along with highly developed verbal and written communication skills;
- Ability to distill complex security concepts clearly for a non-technical audience while operationalizing cyber security frameworks, vulnerability scoring methodologies, exploitability and criticality criteria with technical specialists;
- Ability to influence organizational outcomes, resolve competing priorities, and drive alignment and shared responsibility for cyber security risk reduction across technical and business teams;
- Ability to navigate complexity, provide strategic direction, and exercise sound judgement in support of organizational objectives and evolving risk landscapes.
Working Conditions: Occasional coordination with vendors, project teams, or other interested parties outside of regular business hours may be required to support deadlines or time-sensitive activities.
Pre-employment Requirements - A security clearance will be conducted.
- Successful applicants must provide proof of qualifications.
Workstyle - This position may be eligible to work from home for at least part of the time as one of several flexible work options available to City employees. These arrangements depend on the operational requirements of the role, employee suitability, and are subject to change based on operational needs and corporate direction.
Position and Pay Information - Business Unit: Cyber Security
- Union: Exempt
- Position Type: 1 Permanent
- Compensation: Level M2 $133,008 - 166,260 per annum
- Hours of work: Standard 35 hour work week.
- Days of work: This position works a 5-day work week with 1 day off in a 3 week cycle.
- Location: 133 6 Avenue SE
- Audience: Internal/External
- Apply By: November 4, 2026
- Job ID: 315216
