Executive Information Security Governance and Policy Consultant

Executive Information Security Governance and Policy Consultant

Location: Ottawa (Hybrid/Remote)
Duration: 6 Months
Security Clearance: Secret security clearance

Overview

Our client is seeking a Senior Executive Information Security Governance and Policy Consultant to lead the assessment design and implementation of a comprehensive information protection framework for sensitive government information.

This strategic advisory role requires deep expertise in information security information governance risk management and policy development with a strong understanding of Government of Canada security requirements. The successful consultant will help establish processes controls and governance standards to ensure the secure handling of Protected A and Protected B information throughout its lifecycle including when shared with external organizations.

Key Responsibilities

• Assess current information security governance and information management practices.
• Review and analyze how sensitive information is classified labelled transmitted shared stored retained and securely disposed of.
• Research Government of Canada security policies directives standards and industry best practices.
• Conduct benchmarking activities across federal organizations Crown corporations financial institutions and other regulated sectors.
• Identify gaps risks and opportunities for improving information protection practices.
• Develop or enhance information classification and sensitivity-labelling frameworks.
• Define security controls associated with information classification levels.
• Establish requirements for security markings metadata tagging encryption access controls audit logging retention and secure disposal.
• Assess technology capabilities supporting automated classification data loss prevention (DLP) information protection and secure external information sharing.
• Provide recommendations related to Microsoft Purview Microsoft Information Protection sensitivity labels rights management and related security capabilities.
• Develop policies standards procedures governance models and third-party information-sharing requirements.
• Create implementation roadmaps training materials and executive-level recommendations.
• Support the rollout and operationalization of approved frameworks policies and controls.

Deliverables

Potential deliverables include:

• Current-state assessment and gap analysis
• Research and benchmarking report
• Information classification and sensitivity-labelling framework
• Protected information handling standards
• Secure external information-sharing policies and procedures
• Third-party information protection requirements and guidance
• Technology assessment and recommendations
• Implementation roadmap and change management plan
• Training and awareness materials
• Executive briefings and final recommendations

Required Experience

The ideal candidate will possess:

• Executive-level consulting experience in information security information governance cybersecurity or enterprise risk management.
• In-depth knowledge of Government of Canada security policies directives standards and guidance.
• Demonstrated experience protecting Protected A Protected B or classified information.
• Experience developing and implementing enterprise security policies standards procedures and governance frameworks.
• Strong expertise in information classification security markings metadata tagging and sensitivity labelling.
• Experience managing risks associated with information sharing involving third parties suppliers financial institutions or external partners.
• Knowledge of encryption identity and access management secure transmission data loss prevention records management retention and secure disposal practices.
• Experience researching and benchmarking security practices across government and highly regulated environments.
• Hands-on familiarity with Microsoft 365 security and compliance technologies including:
• Microsoft Purview
• Microsoft Information Protection (MIP)
• Sensitivity Labels
• Data Loss Prevention (DLP)
• Information Rights Management (IRM)
• Excellent stakeholder management executive communication policy development and implementation skills.

Preferred Qualifications

• Experience within the Government of Canada Crown corporations or other highly regulated organizations.
• Professional certifications such as CISSP CISM CRISC CGEIT or relevant Microsoft Security certifications.
• Experience leading enterprise-wide information protection and governance initiatives.