Director, P&T Operations - Incident Management & Risk

Hi there! Thanks for stopping by 👋

Are you actively looking for a new opportunity? Or just checking the market? Well… you might just be in the right place!

We're looking for a Director, P&T Operations - Incident Management & Risk to join our Product & Technology Operations team.

In this role, you'll build and lead the operating mechanisms that help Product & Technology respond effectively to incidents, reduce enterprise risk, and give leaders clear visibility into where attention and action are needed. You'll bring together fragmented processes and practices, establish common standards, improve communications and follow-through, and ensure the right data reaches engineering teams, executives, and security leaders.

You'll work at the intersection of Product & Technology Operations, Engineering, Security, and executive leadership. The scope spans operational and security incidents, vulnerability management, and the mechanisms used to identify, assess, track, and reduce technology risk. You'll also help connect broader enterprise risk areas - including responsible AI, application and infrastructure security, identity and access, data protection, digital supply-chain risk, shadow IT/AI, security compliance, and operational resilience - into a coherent leadership view without becoming the functional owner for each domain.

This is not a traditional PMO role. We're looking for someone who can design and improve how the organization operates, bring structure to complex cross-functional problems, drive action and accountability, and enable the CTO and Security leadership team to operate effectively at executive and board-committee level.
 
## What you'll be doing

Unify and evolve incident management

- Establish a consistent P&T-wide incident management framework, including clear standards, roles, severity definitions, escalation paths, communications, and expectations for follow-through.
- Bring together existing incident practices across teams, preserving what works while creating greater consistency, clarity, and organizational visibility.
- Strengthen post-incident practices so actions are owned, tracked to completion, and translated into systemic improvements rather than isolated fixes.
- Partner with Engineering and Security leaders to continuously improve incident readiness, response effectiveness, and operational resilience.

Strengthen security incident and vulnerability operations

- Partner with Security and Engineering to strengthen the operating mechanisms for security incidents and vulnerability management, including intake, prioritization, ownership, remediation tracking, escalation, and reporting.
- Create clear visibility into material vulnerabilities, remediation progress, aging, exceptions, and areas requiring leadership intervention.
- Ensure security incidents and vulnerabilities connect into broader P&T incident, risk, and executive reporting mechanisms while maintaining clear functional ownership within Security and Engineering.
- Help identify recurring breakdowns in process, ownership, or controls and drive cross-functional improvements.

Create an integrated view of technology risk

- Build the mechanisms that give P&T and Security leadership a clear, actionable view of material technology and operational risks, trends, mitigations, and decisions required.
- Partner with domain owners across responsible AI and AI governance, application and infrastructure security, digital supply-chain risk, identity and access management, Zero Trust, data protection, shadow IT/AI, security compliance, and operational resilience.
- Translate complex risk information into clear priorities, tradeoffs, and actions without duplicating the accountability of the teams that own each risk domain.
- Identify patterns across incidents, vulnerabilities, and risk signals and use them to inform priorities and systemic improvement.

Improve reporting, communications, and executive readiness

- Define the metrics and reporting needed to understand incident health, vulnerability exposure, remediation progress, risk trends, and operational resilience.
- Develop clear executive-level views that surface what matters, where risk is changing, what actions are underway, and where decisions or intervention are required.
- Improve incident and risk communications across technical teams, business stakeholders, executives, and other partners so information is timely, accurate, and appropriate for the audience.
- Enable the CTO and Security leadership team with the operating cadence, insights, and materials needed for executive and board-committee discussions.

Drive cross-functional action and continuous improvement

- Lead complex work across Engineering, Security, Product, Legal, Compliance, and other partners through influence rather than formal authority.
- Create clear ownership and accountability for cross-functional actions, ensuring critical issues do not stall between teams.
- Establish operating cadences that keep material incidents, vulnerabilities, and risks moving toward resolution without creating unnecessary process.
- Continuously assess where processes, tooling, data, or organizational interfaces need to improve and drive those changes through implementation.

Lead the function

- Set the vision and operating model for incident management and technology risk operations within P&T Operations.
- Build strong partnerships with Engineering and Security leadership and act as a trusted advisor on operational readiness, risk visibility, and organizational response.
- Develop the capabilities, processes, and team needed as the scope matures, while remaining willing to operate hands-on where the organization needs it most.

What you need to bring

- Significant experience leading incident management, technology operations, security operations, risk programs, or a closely related function in a complex technology organization.
- Demonstrated experience designing or materially improving incident management processes, standards, communications, reporting, and post-incident follow-through across multiple teams.
- Working knowledge of security incident response and vulnerability management, with the ability to partner credibly with Security and Engineering leaders without needing to be the deepest technical expert in every domain.
- Experience building executive-level risk, incident, or operational reporting that turns complex technical information into clear insights, actions, and decisions.
- Strong understanding of how technology and security risks are identified, prioritized, mitigated, tracked, and communicated in an enterprise environment.
- Experience leading cross-functional change and driving accountability across teams where you do not have direct authority.
- Strong executive communication skills, including the judgment to tailor communications for technical teams, senior executives, and board-level audiences.
- Ability to bring structure to ambiguity, identify systemic issues, and build durable operating mechanisms rather than simply coordinate activity.
- Strong judgment, calm under pressure, and the ability to operate effectively during high-severity or high-visibility incidents.
- A collaborative leadership style and the ability to build trust across Product, Engineering, Security, Legal, Compliance, and executive leadership.

Fuel your growth. Find your people.

At Lightspeed, your growth is our priority. We invest in you with continuous learning opportunities, global mobility and benefits designed to support you—all within a driven, diverse and inclusive team that’s passionate about empowering our communities.

Please note that we ask applicants to disclose any criminal convictions, and we conduct criminal record checks as part of our hiring process for this role.

To all recruitment agencies: Lightspeed does not accept unsolicited agency resumes. If we have not directly engaged your company in writing to supply candidates for a specific vacancy, Lightspeed will not be responsible for any fees related to unsolicited resumes.

Lightspeed is a proud equal opportunity employer and we are committed to creating an inclusive and barrier-free workplace. Lightspeed welcomes and encourages applications from people with disabilities. Accommodations are available on request for candidates taking part in all aspects of the selection process.

Where to from here?

Obviously, this has to be mutually beneficial: we want you to step into a role you love, and we want to offer you a place you’re proud to come to every day. For a glimpse into our world check out our career page here .

Lightspeed is building communities through commerce, and we need people from all backgrounds and lived experiences to do that. We were founded in 2005, in Montreal’s gay village and our original members were all part of the LGBTQ+ community. The ethos of our business has been about inclusion from the very beginning, and we strive to provide a workplace where everyone belongs.

Who we are:

Powering the businesses that are the backbone of the global economy, Lightspeed's one-stop commerce platform helps merchants innovate to simplify, scale, and provide exceptional customer experiences. Our cloud commerce solution transforms and unifies online and physical operations, multichannel sales, expansion to new locations, global payments, financial solutions, and connection to supplier networks.

Founded in Montréal, Canada in 2005, Lightspeed is dual-listed on the New York Stock Exchange (NYSE: LSPD) and Toronto Stock Exchange (TSX: LSPD). With teams across North America, Europe, and Asia Pacific, the company serves retail, hospitality, and golf businesses in over 100 countries.

Lightspeed handles your information in accordance with our Applicant Privacy Statement .