CSIRT Director Job at SITA (Montreal)

CSIRT Director

SITA

Location:
Canada , Montreal

Category:
IT - Administration

Contract Type:
Not provided

Salary:

Not provided

Save Job

Apply Position

Job Description:

The CSIRT Director is a cybersecurity leader responsible for the complete ownership, strategy, and operational execution of the organization's enterprise Computer Security Incident Response Team (CSIRT). The CSIRT Director operates at the strategic, operational, and tactical levels simultaneously, serving as the single point of accountability for all related cybersecurity response functions. This leader directs a globally distributed team across three operations center locations in Montreal (Canada), Cairo (Egypt), and Singapore, ensuring continuous, follow-the-sun security operations coverage. This role reports directly to the Chief Information Security Officer (CISO) and serves as a key member of the cybersecurity leadership team, providing executive-level guidance on threat posture, incident trends, and operational risk.

Job Responsibility:

Continuous Threat Exposure Management (CTEM) - Directs the organization's proactive exposure reduction program. This includes attack surface management, vulnerability prioritization, red team / purple team program oversight, penetration testing governance, and the coordination of remediation workflows with IT and engineering stakeholders.
Cyber Threat Intelligence (CTI) - Commands the intelligence function responsible for producing finished, operationalized threat intelligence. This includes strategic intelligence briefings to CISO and Board, tactical intelligence feeds into detection platforms, threat actor tracking, sector-specific threat analysis (transportation/aviation/border security), and third-party intelligence partnerships.
Incident Response (IR) - Owns the full incident response lifecycle. Accountable for IR planning and playbook governance, crisis management and executive communication during significant incidents, forensic capability oversight, tabletop exercise program, regulatory breach notification coordination, and post-incident reviews (PIRs).
Security Operations (SecOps) Collaboration - Direct and optimize resources across global SOC locations (Montreal, Cairo, Singapore), ensuring consistent standards, 24/7/365 coverage through a follow‑the‑sun operating model, and resilient business continuity with defined failover capabilities. Drive collaboration and intelligence sharing across sites while managing MSSP and third‑party partners to ensure performance, accountability, and unified global operations.
Strategic Leadership & Governance - Define and lead a multi‑year global CSIRT strategy, serving as the single point of accountability for threat exposure, intelligence, and incident response while aligning capabilities to business risk and industry frameworks. Own executive reporting, budget planning, and the establishment of clear SLAs and KPIs to ensure a mature, scalable, and effective cybersecurity operations program.
People Leadership & Talent Development - Lead, develop, and retain a high‑performing global cybersecurity operations team across CTEM, CTI, and Incident Response, fostering an inclusive, high‑accountability culture that enables collaboration across regions and time zones. Establish clear career pathways, performance management, and succession planning while overseeing staffing models, shift coverage, and on‑call operations across all SOC locations.
Executive & Stakeholder Engagement - Act as the primary liaison to the CISO, delivering executive‑ and board‑level insights on security operations, threat posture, and incident response effectiveness. Partner cross‑functionally with architecture, engineering, GRC, legal, and IT teams, and represent CSIRT in audits, regulatory reviews, and customer security engagements.

Requirements:

15+ years of progressive experience in cybersecurity, with at least 7+ years in a senior leadership role with direct accountability for security operations.
5+ years of direct experience managing large, geographically distributed Security Operations Centers (SOCs) — including multi-site, multi-shift, 24/7/365 operations.
Bachelor's degree in computer science, Information Systems, Information Security, or a related discipline
or equivalent professional experience.
Active professional certification in at least one of the following: CISSP, CISM, CISA, GIAC GSOM, GIAC GCIH, or equivalent.
Proven experience managing global teams across multiple time zones and cultures, with a track record of building cohesive, high-performing distributed teams. With demonstrated ownership of an Incident Response Function and Team.
Demonstrated ownership of two or more of the following functions: SOC, CTEM / Vulnerability Management, Cyber Threat Intelligence,
Strong command of the MITRE ATT&CK framework, NIST CSF, and incident response methodologies (SANS PICERL, NIST 800-61).
Executive-level communication skills — ability to translate complex technical threats into business risk language for CISO, C-suite, and Board audiences.

Nice to have:

Experience in the aviation, transportation, border security, or critical national infrastructure sectors.
Hands-on background in threat hunting, malware analysis, digital forensics, or red team operations.
Experience leading or overseeing a CTEM/BAS (Breach and Attack Simulation) program.
Familiarity with security platforms including Elastic/Splunk SIEM, CrowdStrike/SentinelOne EDR, ServiceNow SecOps, Recorded Future or Mandiant Advantage CTI platforms.
Proficiency in DevSecOps and cloud security principles (AWS, Azure, GCP) in the context of SOC monitoring.
Experience with NIST 800-53, ISO 27001, PCI DSS, and SOC 2 compliance environments.
Master's degree or Executive Education in Cybersecurity, Business Administration, or Risk Management.

What we offer:

Work from home up to 2 days/week (depending on your team’s needs)
Flex Day: Make your workday suit your life and plans.
Flex Location: Take up to 30 days a year to work from any location in the world.
Employee Wellbeing: Employee Assistance Program (EAP) for you and your dependents 24/7, 365 days/year
Champion Health platform.
Professional Development: Access to world-class learning platforms including LinkedIn Learning, Microsoft's Enterprise Skills Initiative, Airport Council International, Pluralsight, Harvard Business Publishing, Stanford and many others.
Competitive Benefits: Competitive benefits that make sense with both your local market and employment status.

Additional Information:

Job Posted:
May 05, 2026

Employment Type:

Fulltime

Work Type:

Hybrid work

SITA - All Job Offers

Job Link Share:

CSIRT Director

SITA

Location:
Canada , Montreal

Category:
IT - Administration

Contract Type:
Not provided

Salary:

Job Description:

Job Responsibility:

Requirements:

Nice to have:

Additional Information:

Job Posted:
May 05, 2026

Looking for more opportunities? Search for other job offers that match your skills and interests.

Similar Jobs for CSIRT Director

Technician, Refrigeration/HVAC

Software Engineer II

Mechanical Rotating Technician

Store Manager in Training

Trainee Pest Control Technician

Human Resources Coordinator

Pharmacy Manager

Shift Supervisor

CSIRT Director

SITA

Location:Canada , Montreal

Category:IT - Administration

Contract Type:Not provided

Salary:

Job Description:

Job Responsibility:

Requirements:

Nice to have:

Additional Information:

Job Posted:May 05, 2026

Looking for more opportunities? Search for other job offers that match your skills and interests.

Similar Jobs for CSIRT Director

Technician, Refrigeration/HVAC

Software Engineer II

Mechanical Rotating Technician

Store Manager in Training

Trainee Pest Control Technician

Human Resources Coordinator

Pharmacy Manager

Shift Supervisor

Location:
Canada , Montreal

Category:
IT - Administration

Contract Type:
Not provided

Job Posted:
May 05, 2026