Senior Manager, Technology Risk & Controls

Choose a workplace that empowers your impact.

Join a global workplace where employees thrive. One that embraces diversity of thought, expertise and passion. A place where you can personalize your employee journey to be - and deliver - your best.

We are a leading global real estate investor, developer and manager. We combine our capital with our capabilities to create real estate that strengthens economiesand communities. By prioritizing people, partnerships and places, we generate meaningful returns for OMERS members, enhance value for our capital partners and create a brighter world for our customers.

Join us to accelerate your growth & development, prioritize wellness, build connections, and support the communities where we live and work.

Don’t just work anywhere - come build tomorrow together with us.

Know someone at OMERS or Oxford Properties? Great! If you're referred, have them submit your name through Workday first. Then, watch for a unique link in your email to apply.

Role Summary:

Oxford owns and operatesone of the world’s best knownreal estate portfolios, and the technology inside those buildings is now core operating infrastructure. This role owns the independent assurance programover that technology. It isthe objective check that controls are properlydesigned, working as intended, and evidencedto a standard Oxford can stand behind.

The role reports to the Director, Operational Technology andCybersecurity, with a direct escalation route to Operational Risk and to the relevant risk or audit committee. This is a secondline mandate. Theoperating teams own and run the controls;this role tests them, forms a conclusionand reports it. Assurance conclusions donot require signoff fromthe function being assessed.

You will lead a small assurance team and build a programthat is still taking shape. Methodology, standards, cadenceand reporting are yours to define, with executive and committee visibility from the start.

The role coversa global portfolio of propertiesacrossCanada, the United States, the United Kingdom, continental Europe, Singaporeand Australia. It carries genuineindependence, executive accessand committee exposure, and you willbuild both the program and theteam from the ground up.

You will be responsible for:

• Owning the assurance program over property technology, coveringmethodology, risk-based planning, scope, sampling, testing, findings and the annual conclusion,and standing behind that conclusionevenwhen it is unfavorable.

• Owning the internal controls framework as it applies to property technology: control design standards, evidence requirements, testing expectations, and the mapping between the technology control set and Oxford’s wider control obligations.

• Running the annual evidence and attestation cycle end to end, includingplanning, evidence standards, testing, exceptions and observations, and the position submitted.

• Leading the risk cycle: identifyingfindings, evaluating the controls behind them, recommending solutions, validatingremediation, performing root cause analysis on control failures, and facilitatingresidual risk acceptance where remediation is not pursued.

• Delivering technology assurance on transactions: assessing the technology and control position of assets entering the portfolio, assuring a secure and evidencedexit for those leaving it, and riskassessing significant technology initiatives before they reach the estate.

• Owning the incident readiness exercise program, includingscenario design, delivery, evaluation and carryforward actions, withscenarios drawn from the real incident and nearmiss record.

• Building the metrics that surface control weakness, includingcontrol environment health, exception trendsandremediation ageing,read against risk appetite, alongside recurring secondline monitoring such as restricted access review.

• Reporting to executives and committee, translating control and risk findings into business terms leaders can act on, and acting as the coordination point for internal and external audits.

• Partnering across the three lines with Compliance, Enterprise Operational Riskand Internal Auditso the approach to technology risk stays consistent,and leading, coaching and developing the assurance team.

• Decision authority You will set the assurancemethodology, scope, sampling approachand testing standard, and decide what counts assufficient evidence for a control. You also determinecontrolratingsand findings, the attestation position submitted, exercisescope and evaluation criteria, the assurancerequirements applied to acquisitions and dispositions, and theprioritiesof the program.

Required Skills & Experience

• 8+ years in assurance, internal controlsor audit practice, including methodologydesign, sampling and evidence testing.

• Demonstrated experience designing control frameworks and mapping them to enterprise risk and regulatory obligations, with working knowledge of recognizedframeworks such as COBIT, ISO 27001 and the NIST Cybersecurity Framework.

• Experience running the full risk cycle: assessment, control evaluation, remediation validationand residual risk acceptance.

• Enoughtechnical depthacross network, platform, securityand application domains to test technology controls directlyrather than rely on what is asserted.

• Proven executive and committee-level reporting, with the ability to put technology and audit findings in business terms.

• Peopleleadership experience, including coaching and performance management.

• The professional judgement and credibilityto hold an independent position within the structure you assess, and to escalatewhen it is warranted.

Preferred Skills & Experience

• A professional designation such asCPA, CIA, CISA, CISSP or equivalent.

• Experience developing control metrics and measurement where none existed before.

• Exposure toreal estate, infrastructureor other multi-site operating environments, or to buildingtechnology and operational technology estates.

• Experience assuring technology in a multi-jurisdictional portfolio.

• Bachelor’s degree or equivalent experience.

We believe that time together in the office is important for OMERS and Oxford, the strength of our employees, and the work we do for our pension members. In delivering on our pension promise, keeping us connected to our work and each other, our flexible hybrid work guideline requires teams to come in to the office 4 days per week.

You may also be eligible to receive an annual Incentive Award pursuant to our Short-term Incentive plan and our Long-Term Incentive plan (if applicable), and to participate in our group benefits and retirement plans - details on these elements of compensation are included within OMERS & Oxford offer letters.

Oxford's purpose is to strengthen economies and communities through real estate.

Our people-first culture is at its best when our workforce reflects the communities where we live and work - and the customers we proudly serve.

From hire to retire, we are an equal opportunity employer committed to an inclusive, barrier-free recruitment and selection process that extends all the way through your employee experience. This sense of belonging and connection is cultivated up, down and across our global organization thanks to our vast network of Employee Resource Groups with executive leader sponsorship, our Purpose@Work committee and employee recognition programs.

Artificial intelligence (AI) tools are used to support certain stages of the OMERS recruitment process. While AI assists us in our process, human judgment and decision-making remain central to our candidate experience.