Sr. Security Architect – Hybrid in Toronto

The purpose of this request is to onboard a contingent cyber security resource to support the Director, Cyber Security Defence & Resilience, with operational and strategic initiatives across the Agency and the broader Ontario health sector. This role sits within the Agency’s broader AI-Driven Risk Program and mitigation plan, established to counter rapid increases in adversarial AI and machine-speed cyber attacks. The resource will focus on two primary, non-forensic areas:

• Cyber Security Incident Response (CSIR): Enhancing program maturity, governance, day-to-day coordination, and stakeholder communication.
• Zero Trust Implementation: Assessing current security architecture and driving hands-on operationalization of identity, access, and network controls.

Responsibilities & Deliverables

• Cyber Security Incident Response (CSIR) Program
• Mature the Program: Review, update, and standardize incident response (IR) policies, workflows, procedures, and playbooks in alignment with NIST standards.
• Lead Coordination: Act as a lead responder and coordinator for confirmed internal and large-scale external cyber incidents affecting the healthcare sector.
• Communications & Reporting: Build executive briefings, situational reports (SITREPs), and incident summaries. Guide communications with internal teams and external healthcare stakeholders.
• Performance & Readiness: Define KPIs, track program metrics, lead post-incident reviews, and support tabletop simulation exercises. Adapt playbooks for AI-accelerated threats.
• Zero Trust Implementation & Operationalization
• Gap Analysis: Assess current-state architecture to identify and document flaws in identity, access, and network security controls.
• Hands-On Implementation: Lead the deployment, configuration, and integration of Zero Trust-aligned technologies alongside technical teams. Focus Domains: Enforce practical controls surrounding identity (MFA, Conditional Access, PAM/PIM, RBAC) and network security (micro-segmentation, ZTNA).
• Process Embedding: Translate abstract Zero Trust concepts into measurable, daily operational controls, ensuring architecture patterns integrate cleanly across identity, endpoint, and network domains.

Required Skills & Experience

• Experience: 7–10 years of dedicated experience in cyber security with strong exposure to CSIRT or SOC environments.
• Incident Management: Proven experience leading and managing the full incident lifecycle, including cross-functional and external stakeholder coordination under high-pressure conditions.
• Zero Trust Delivery: Demonstrated hands-on implementation experience with Zero Trust frameworks, specifically translating strategy into deployed infrastructure rather than just designing models.
• Technical Toolsets: Strong working knowledge of the Microsoft security ecosystem (Entra ID, Defender, Sentinel) and AWS security tools (GuardDuty, Security Hub).
• Modern Threat Awareness: Solid understanding of the modern AI-driven threat landscape, including machine-speed exploitation and attack vectors.

Education & Certifications

• Relevant professional certifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer).

Desired Skills

• Sector Knowledge: Prior experience working in public sector or healthcare environments (familiarity with PHIPA laws is a plus).
• Frameworks: Strong familiarity with regulatory and security standards such as NIST CSF and ISO 27001.
• Automation: Exposure to SOAR (Security Orchestration Automation and Response) platforms and automated incident workflows.