Senior Information Security Specialist

Reporting to the Manager, Information Security, the Senior Information Security Specialist is responsible for the systems that provide information security and protect Manitoba Liquor & Lotteries (MBLL) from cyber threats. As a senior resource within the Information Security Department, the position lead aspects of the security program, conduct, and review complex security assessments, as well as provide specialized security expertise inclusive of, but is not limited to, MBLL information technology infrastructure, cloud services, First Nation Casinos and other associated technologies, processes and personnel that are managed or operated by MBLL.

• Perform assigned daily tasks from the information security runbook to ensure ongoing security and that detected issues are promptly addressed.
• Coordinate the resolution of information security work requests through assigned IT Service management (ITSM) tickets, emails, phone calls, etc.
• Lead aspects of MBLL’s information security programs as a senior Subject Matter Expert (SME), including Vulnerability Management, Security Events Information Management (SIEM), Endpoint Detection & Response (EDR), Incident Response, PKI/Cryptography, Identity & Access Management (IAM), Privileged Access Management (PAM), and cloud technologies.
• Lead small projects and initiatives within the Information Security Department to maintain technical currency or implement new cybersecurity capabilities.
• Plan, configure, and support information security technologies that protect MBLL business-critical networks and servers, including firewalls, Virtual Private Networks (VPN), secure remote access, secure authentication, and file system monitoring.
• Work closely with ITS technical teams to ensure cybersecurity controls, best practices, and mitigation strategies are effectively implemented and maintained.
• Respond to and resolve support requests (ITSM tickets, phone calls, e-mails, etc.) for the Information Security Department promptly.
• Communicate discovered vulnerabilities and provide recommendations on mitigation to appropriate staff and management.
• Design, develop, and deliver information security awareness training and education to all employees.
• Perform periodic reviews and audits of information systems to ensure security controls, policies, standards, and regulatory compliance are in place.
• Assist, train, and mentor other cybersecurity and ITS team members in the use of security tools, application of security standards, and resolution of security issues.
• Develop insightful analysis and reporting of information security metrics, such as network traffic anomalies, phishing attempts, and vulnerability exposure.
• Develop, maintain, and enforce security operations policies, standards, and processes (run books), seeking continuous improvement.
• Conduct file integrity monitoring and reporting of gaming systems and retail operations.
• Participate in an on-call rotation, providing after-hours support for urgent security issues.
• Analyze logs and events from critical information systems for suspicious or abnormal activity.
• Scan incoming emails for phishing attempts and other malicious content.
• Implement web content filtering, anti-virus, and anti-spyware technology to protect against non-business appropriate and malicious websites.
• Provide secure storage of system passwords and sensitive documents.
• Conduct network monitoring for malicious and suspicious activity.
• Perform vulnerability and risk assessments on new and existing information systems, developing reports for management review.
• Manage information security incidents following the incident response plan, including detection, identification, analysis, investigation, response, and recovery.
• Assist in the development of the information security incident response plan.
• Conduct investigations as requested by senior management or Corporate Security.

• Represent the Information Security Department on business project teams as a senior technical resource and act as a risk advisor. Conduct risk analysis and advise project teams on cyber security risk and related mitigations and best practices in alignment with MBLL’s risk assessments and third-party risk management practices.
• Perform ad-hoc cyber security risk assessments on technology systems and business solutions and create reports for senior management.
• Participates in information security architecture and system design development, ensuring that all activities adhere to MBLL’s information security principles, standards, and processes.
• Develop and maintain Key Performance Indicators (KPIs) to report on important information security program health and risk indicators.
• Participate in the development of information security policies that support the security strategy and corporate business objectives.
• Provide information required for the budgeting process, monitor spending, and use technical knowledge to ensure that resources required for projects and systems maintenance are utilized efficiently and responsibly.
• Assist, train, and mentor ITS team members in the use of security tools, application of security standards, and resolution of security issues, while actively promoting and modeling good information security practices through participating and facilitating cross-training opportunities, information security campaigns and delivering presentations to strengthen a strong cyber security culture.
• Champion Corporate Responsibility (CR) by leading corporate CR strategic initiatives and ensuring corporate responsibility (consumer, environmental and community) and corporate reputation risks and opportunities are considered in business decisions and integrated into products, plans and corporate culture.
• As a Subject Matter Expert (SME), work with other MBLL staff and project teams to research, design, and implement information security solutions.
• Lead technical investigations of information security incidents by following information security incident response plans and playbooks for detection, identification, analysis, investigation, response, and recovery.
• Coordinates eradication and mitigation activities with business and IT partners for security incident recovery related to IT or business application / infrastructure security incident.
• Perform threat, vulnerability, and forensics analysis. Continuously monitor and evaluate security events, vulnerabilities, and exploits. Implement decisive actions to safeguard organizational assets against identified threats, minimizing potential business disruptions.
• Actively monitor information security technologies used by MBLL and respond to detected malicious or suspicious events.
• Contribute to and assist leading the development of incident response plans and playbooks and participate in validation activities with table‑top exercises and simulations.
• Other related duties as assigned.

• Completion of a recognized degree or a two-year college diploma in Computer Science or similar discipline, or an equivalent combination of education, certification, and experience.
• A minimum of five years of Information Technology (IT) experience with a minimum of three years experience performing information security functions.
• One or more professional information security certifications, in good standing, such as CISSP, CISM, CRISC, OSCP, SANS GIAC, etc.
• Strong communication and interpersonal skills.
• Experience and proficiency in Microsoft 365 (Word, Excel, PowerPoint, Teams and Outlook)
• Demonstrated initiative, and ability to prioritize, and achieve results in a timely manner.
• Working knowledge of general enterprise IT concepts including but not limited to operating systems, applications, databases, network technologies.
• Working knowledge of information security concepts such as Security Information Event Management (SIEM) systems, Security Orchestration & Automated Response (SOAR), Intrusion Detection and Prevention Systems (IDS/IPS), endpoint protection, Cloud security controls and M365, vulnerability management practices, Cloud Access Security Brokers (CASB), web application security scanning and monitoring, encryption technologies, patch management, Firewalls/VPNs, Identity and Access Management (IAM), Privileged Access Management (PAM).
• Have and maintain a valid Manitoba Class 5 Drivers License and access to a reliable vehicle.
• The core competencies for this position include achieving quality results, adaptability/managing change, communication, customer service, decision making and problem solving, integrity and building trust, teamwork and cooperation and valuing diversity. These competencies are deemed important for the success of the position and organization.

• Knowledge of PCI and gaming-industry regulatory requirements and their potential impact on the organization from an information security perspective.
• Experience in scripting languages such as PowerShell or Python.
• Demonstrated record of continuing cyber security education and certifications. Committed to continuous education and recertification to maintain professional certifications and keep current with evolving cyber security technologies, trends, and threats.
• Possess an understanding of cyber security concepts, controls, frameworks, and standards including NIST and ISO.
• Ongoing professional development and recertification are required to maintain certifications and keep up to date in information technology.
• Bilingual French/English language skills are an asset.

***Testing may form part of the screening/selection process. Employment Equity will be a factor in the recruitment process. Circumstances may arise where the bulletin may need to be withdrawn or the number of positions may need to be increased depending on the Collective Agreement.