[Hiring] Lead AI & Third-Party Risk Security Assessor @Manulife

Role Description

As a Lead AI & Third-Party Risk (TPRM) Security Assessor within Global Cybersecurity Services, you will play a key role in strengthening the organization’s security posture as we expand the use of AI-enabled solutions and third-party technologies. You will lead the security assessment of AI products, AI-bearing vendors, and enterprise technologies—ensuring risks are identified, evaluated, and managed in alignment with regulatory expectations and business objectives. This includes addressing emerging threats such as AI-driven attacks, agentic risks, and supply chain vulnerabilities. This role combines deep technical expertise with strategic influence. You will define and evolve modern assessment practices, partner across functions, and provide trusted guidance on complex risk decisions. The ideal candidate is curious, forward-thinking, and thrives in a fast-evolving technology and threat landscape.

• Lead and approve security assessments for AI-enabled products, AI-bearing vendors, and third-party technologies
• Act as the escalation point and named reviewer for high-risk and AI-related engagements
• Define and continuously improve AI-focused assessment frameworks, including controls, evidence standards, and scoring models
• Drive automation of assessment processes to improve efficiency, scalability, and turnaround time
• Partner with TPRM, Procurement, Legal, Privacy, and Architecture teams to embed security into vendor selection and lifecycle processes
• Provide expert advice on regulatory, legal, and third-party risk implications during solution design and vendor selection
• Maintain audit-ready documentation and support regulatory compliance (e.g., OSFI B-13)
• Produce risk reporting and insights for cybersecurity leadership
• Monitor emerging AI threats and regulatory developments and integrate them into assessment practices
• Mentor junior team members and support capability development

Qualifications

• 8+ years of experience in information security, including third-party risk or security assessments
• Strong expertise in vendor/product security assessments and control evaluation
• Experience assessing cloud, SaaS, and AI/ML vendor environments
• Understanding of AI-related risks (e.g., data exposure, prompt injection, model vulnerabilities)
• Familiarity with security frameworks and regulations (e.g., OSFI, NIST, ISO)
• Strong stakeholder management and communication skills
• Ability to lead complex initiatives and influence risk-based decisions

Requirements

• Experience with assessment automation or GRC tools
• Knowledge of AI governance and emerging regulatory frameworks
• Relevant certifications (CISSP, CISM, CISA, or similar)
• Experience in financial services or regulated environments

Benefits

• Customizable benefits, including health, dental, mental health, vision, short- and long-term disability, life and AD&D insurance coverage
• Adoption/surrogacy and wellness benefits
• Employee/family assistance plans
• Various retirement savings plans (including pension and a global share ownership plan with employer matching contributions)
• Financial education and counseling resources
• Generous paid time off program including holidays, vacation, personal, and sick days
• Full range of statutory leaves of absence