Lead Information Security Analyst, Continuous AI Risk Management Expert (T & I) (TeleworkHybrid)

Position Title:

Status of Employment:

Position Language Requirement:

Language Skills:

Work at CBC/Radio-Canada

At CBC/Radio-Canada we create content that informs entertains and connects Canadians on multiple platforms. Our successes and accomplishments are driven by embodying and upholding values which include creativity integrity inclusiveness and relevance.

Do you think you have the ability and drive to keep up with this exciting ever-changing industry Whether it be in front of the camera on air online or behind the scenes you would be joining a team that thrives on making connections and telling stories that are important to Canadians.

Unposting Date:

Behind the scenes but ahead of the curve: help us develop the next-generation public service media organization.

Technology & Infrastructure (T&I) is the backbone and the future-forward arm of CBC/Radio-Canada. Our purpose is to constantly innovate to evolve and maintain the Corporations technology and infrastructure. We are the people that make stuff work. We make connections between media content systems people and places. We are the space in between.

A place with purpose. CBC/Radio-Canada has always been a highly regarded pioneer of media technology not just in Canada but around the world. Today we are transforming ourselves into a modern and agile public service media organization. Technology is the driving force and we are the team making it happen.

This is a hybrid role with a mix of in-office and remote work. Work arrangements will be discussed with hiring managers per departmental guidelines.

Your Role

CBC/Radio-Canada is seeking a Lead Analyst Continuous AI Risk Management Expert to design build and lead the enterprise-wide governance security and continuous risk management program for artificial intelligence (covering both traditional AI and generative AI) across the Corporation.

In this role you will design and deploy an enterprise AI risk assessment framework and conduct continuous evaluations of AI systems throughout the AI life cycle (from design to production). You will collaborate closely with data protection analysts as well as the legal compliance and enterprise architecture teams to identify measure and mitigate cybersecurity risks associated with AI technologies.

This position can be based in Montreal or Toronto.

Whats in It for You

Challenges. We spend our days solving problems of all kinds. Media files are highly nuanced and incredibly complicated; updating installing and supporting technologies that are organization-wide and that impact broadcasting content is a time-sensitive complex technical feat. And thats just the beginning. Youll be working with leading-edge data management cloud IP broadcasting AI security and reliability technologies.

As Lead Analyst you will:

• Design and deploy the AI risk assessment framework: Develop formalize and implement a standardized risk assessment methodology tailored to AI systems including ethical impact matrices model criticality criteria bias analysis algorithmic vulnerability assessments and data exposure risks.
• Support enterprise AI governance architecture: Collaborate closely with architecture teams and governance committees to design integrate and evolve the security foundation for AI technologies across the Corporation.
• Maintain the AI inventory and classification: Build and manage a centralized registry of all AI systems models (internal SaaS open-source) and AI agents deployed across the organization classified by risk level.
• Conduct continuous model risk assessments: Perform technical risk evaluations on new AI use cases analyzing training data security prompt/query confidentiality algorithmic bias and intellectual property risks.
• Perform AI security testing: Define and execute specialized security and adversarial testing for AI and large language models (LLMs).
• Assess third-party AI and SaaS solutions: Partner with the Third-Party Risk Management (TPRM) Analyst to evaluate the security posture privacy controls and model-training policies of external vendors. Provide specialized AI expertise to analyze contractual data-use terms (e.g. ensuring corporate data is not used for model training) evaluate SaaS API security and verify privacy guarantees in third-party environments.
• Manage the AI risk register: Document maintain and map AI-specific model vulnerabilities technical debt and approved exceptions in the risk register.
• Assess program maturity: Conduct periodic evaluations of AI governance maturity developing dashboards and tracking key performance indicators (KPIs) and key risk indicators (KRIs) for executive and governance committees.
• Maintain industry expertise: Stay current on information security best practices and industry trends.

What You Bring

• University degree in computer science IT or information security.
• Minimum five years applied experience in IT security data governance or technology risk management.
• Demonstrated experience in designing or implementing risk assessment methodologies and evaluating AI models.
• Proven ability to translate complex AI concepts into structured risk frameworks for project teams with a deep understanding of AI architectures and AI-specific attack vectors.
• Extensive knowledge of security technology and risk assessment methodologies policies and processes.
• Excellent written and verbal communication skills with a demonstrated ability to translate complex technical concepts for non-technical decision-makers (e.g. governance committees business units legal teams).
• Excellent analytical evaluative and problem-solving abilities.
• Experience with compliance programs as well as their technical and security requirements.
• Technical expertise across key domains:
  • Standards and Frameworks: Strong command of industry standards such as ISO/IEC 27005 NIST SP 800-53 / 800-161 COBIT and ITIL.
  • Cloud and Web Architecture Security: Solid understanding of web infrastructure and cloud environment security.
  • Network and Security Technologies: Thorough understanding of network architectures (LAN/WAN routers) network security technologies (firewalls IDS/IPS DNS web filtering) and cryptographic principles (encryption at rest and in transit).
  • Architecture and Data Security: Working knowledge of database architecture concepts and secure software development best practices.
  • Operational Resilience and Physical Security: Solid understanding of business continuity and disaster recovery planning (BCP/DRP) operational resilience and physical security controls.
• Relevant professional security certifications a definite asset (e.g. CISSP CRISC CBCP CISA CISM or equivalent).
• Bilingualism (English and French) essential.

Candidates may be subject to skills and knowledge testing.

We thank all applicants for their interest but only candidates selected for an interview will be contacted.

As part of our recruitment process candidates who advance to the next

step will be asked to complete a background check. This includes:

• A mandatory Criminal record check.

• Other background checks may be conducted based on the operational requirements of the position.

CBC/Radio-Canada is committed to being a leader in reflecting our countrys diversity. Thats because we can only create and tell the stories that connect Canadians by having a workforce that mirrors the ever-changing makeup of our country. Thats why we as an employer value equal opportunity and nurture an inclusive workplace where our individual differences are not only recognized and valued but also extend to and pervade all the services we provide as Canadas public broadcaster. For more information visit the Diversity and Inclusion section of our website. If you have accommodation needs at this stage of the recruitment process please inform us as soon as possible by sending an e-mail to .

You are invited to consult and familiarize yourself with our Code of Conduct which can be found on our corporate website. All employees must adhere to the Code as a condition of employment. We also invite you to take a look at our policy on conflicts of the event that you become an employee it will be important to inform us as quickly as possible of any situation that because of your hiring constitutes or could appear to constitute a conflict of interest.

Primary Location:

Number of Openings:

Work Schedule: