Manager, Technology Risk Management, Information & Corporate Security

Title: Manager, Technology Risk Management, Information & Corporate Security (12 Month Contract) Location: Toronto

Location: Toronto Employment: Full time Purpose. Performance. People. Joining CPP Investments means joining one of the world’s most admired and respected institutional investors to drive a single mandate: to deliver strong, sustainable returns for generations of Canadians. With a long-term horizon and global reach, we deploy capital at scale across public and private markets. Our size, stability, and disciplined investment philosophy allow us to pursue complex opportunities and build enduring partnerships worldwide. For our people, this means meaningful work with tangible impact, real opportunity, and collaboration with exceptional colleagues who value partnership and performance. Here, you’ll contribute to outcomes that matter alongside team members committed to excellence and shared success.

The Role

Reporting to the Managing Director, Cyber & Technology Risk Management, you will execute first line of defence Technology and Information Security control testing to assess the design and operating effectiveness of key controls across the technology environment. You will partner with Technology, Engineering, Infrastructure, Cloud, Application, and Information Security teams to identify control gaps, support remediation, and strengthen CPP Investments' technology control environment through disciplined, risk-based testing and continuous improvement.

The Team

Technology & Operations enables CPP Investments' global investment platform by delivering secure, resilient, and innovative technology capabilities that support our long-term investment mandate. The department partners across the organization to manage technology risk while enabling business performance through effective governance, security, and operational excellence. The Cyber & Technology Risk Management team provides first line oversight of technology and information security controls by embedding risk management practices into day-to-day operations. The team partners closely with technology stakeholders to strengthen the control environment through consistent, scalable, and risk-based control testing practices.

Accountabilities

• Execute end-to-end Technology and Information Security control testing, including planning, walkthroughs, evidence review, sampling, re-performance, and documentation.
• Assess the design and operating effectiveness of technology and security controls using a risk-based approach aligned to applicable standards.
• Develop and maintain control documentation, testing procedures, evidence requirements, and centralized control libraries to support consistent testing practices.
• Identify control deficiencies, determine root causes, and partner with control owners to develop practical and sustainable remediation plans.
• Track remediation activities, perform validation testing, and support audit readiness through coordination with second line risk and Internal Audit teams.
• Leverage data analytics, automation, and GRC tools to improve testing efficiency, evidence collection, and continuous control monitoring.
• Contribute to the ongoing enhancement of first line control testing methodologies, documentation standards, and quality assurance practices.

What You Bring

• Undergraduate degree in Computer Science, Information Security, Engineering, Risk Management, Business, or a related discipline.
• 6–8 years of progressive experience in Technology Risk, IT Audit, Information Security, Internal Controls, or a related discipline within a complex organization.
• Professional certification such as CISA, CISM, CRISC, CISSP, or an equivalent designation is considered an asset.
• Demonstrated experience executing Technology and Information Security control testing, including evidence inspection, sampling methodologies, and re-performance.
• Strong understanding of technology risk and control frameworks including NIST CSF, NIST 800-53, ISO 27001, COBIT, COSO, and modern technology environments such as cloud platforms and DevSecOps.
• Experience using automation, analytics, scripting, and GRC platforms (such as ServiceNow) to enhance control testing and monitoring.
• Excellent analytical, communication, stakeholder management, and problem-solving skills, with the ability to translate technical findings into clear business risk insights.
• You are motivated to contribute to something larger than yourself, approach complex challenges with rigor, and hold yourself to high standards in a collaborative, performance-driven environment. We provide colleagues with cutting-edge AI tools, dedicated learning time, and practical support to help them deliver with greater impact.

Inclusion & Accessibility

CPP Investments is committed to equitable access to employment and building a workforce that reflects diverse talent and perspectives. If you require accommodation at any stage of the recruitment process, please let us know and we will work with you to meet your needs.

CPP Investments may use AI tools to help screen and assess applicants by analyzing resumes and applications for relevant skills and experience. These tools support, but do not replace, human decision-making.