Senior Security Architect in Toronto

Pay Rate: Flexible - Hybrid

Location: Toronto, Ontario

Contract Length: 8 Months

Responsibilities:

• CSIRT (Cyber Security Incident Response Team): Lead program maturity initiatives, including:
• Developing and maintaining incident response procedures, playbooks, policies, and standards
• Establishing and improving incident response governance, processes, and workflows
• Defining KPIs, metrics, and reporting for program effectiveness
• Supporting tabletop exercises and simulation activities
• Collaborate with stakeholders across the Agency and the health sector to:
• Support coordinated incident response and communication
• Provide advisory support during sector-wide cyber incidents
• Promote cyber resilience and standardized security practices
• Support incident response readiness for AI-accelerated / machine-speed threats, including faster containment and “breach vs. break” decision playbooks
• Support and enhance the Cyber Security Incident Response program, including:
• Coordinating cyber incident response activities across internal teams and external stakeholders
• Acting as a key point of contact for incident communications, including engagement with external partners and sector organizations
• Developing incident reports, executive briefings, and communication materials
• Supporting incident response activities (non-forensic), leveraging CSIRT/SOC experience
• Zero-Trust Drive practical integration across domains, including:
• Translating Zero Trust principles into enforceable controls, processes, and standards
• Supporting alignment across identity, endpoint, and network security components
• Bridging strategy, architecture, and day-to-day operations
• Align Zero Trust and identity work to the program’s workstreams — particularly legacy modernization & Zero-Trust controls, Securing external doors (MFA/Conditional Access), and accelerated vulnerability remediation — contributing to these efforts at a supporting level
• Support and deliver Zero Trust implementation, including:
• Assessing current-state architecture and identifying gaps in identity, access, and network security controls
• Supporting or leading hands‑on implementation of Zero Trust‑aligned technologies, particularly in identity
• Working closely with technical teams to configure, integrate, and operationalise security solutions
• Ensuring Zero Trust capabilities are embedded into operational practices, not just deployed

Desired Skills:

• Experience in healthcare or public sector environments, particularly Ontario health sector
• Familiarity with regulatory and security frameworks (e.g., PHIPA, NIST CSF, ISO 27001)
• Experience supporting cross‑organisational incident response coordination
• Experience implementing Conditional Access, PAM/PIM (Privileged Access Management / Privileged Identity Management), or identity governance solutions
• Exposure to Zero Trust maturity models or assessments
• Knowledge of cloud security environments
• Experience with network micro‑segmentation or Zero Trust Network Access (ZTNA)
• Experience with SOAR (Security Orchestration Automation and Response) platforms or automation of incident workflows
• Relevant certifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer)
• Familiarity with defending against AI‑driven / adversarial‑AI threats and machine‑speed attack techniques
• Exposure to program‑delivery models where security work is organised into coordinated workstreams (e.g., attack‑surface reduction, CTEM, AI‑enabled detection)

Required Skills:

• Minimum 7–10 years of experience in cyber security, with strong exposure to Incident Response / Security Operations (CSIRT/SOC)
• Proven experience coordinating and managing cyber incidents, including communication with internal and external stakeholders
• Strong ability to produce clear, concise reports, executive briefings, and incident communications
• Experience developing incident response procedures, policies, standards, and playbooks
• Proven hands‑on experience implementing Zero Trust technologies, particularly in identity and access management (IAM)
• Demonstrated ability to assess security environments and identify gaps, especially across identity and network security domains
• Strong experience with identity‑focused controls (e.g., MFA, Conditional Access, identity governance, privileged access)
• Practical experience translating Zero Trust concepts into operational controls and measurable outcomes
• Experience working with Microsoft security ecosystem (e.g., Defender, Sentinel, Entra ID) and AWS security ecosystem (e.g., Guard Duty, Security Hub)
• Solid understanding of network security concepts aligned to Zero Trust (e.g., segmentation, secure access models)
• Excellent written and verbal communication skills, including executive‑level engagement
• Working awareness of the modern AI‑driven threat landscape (e.g., AI‑accelerated exploitation, automated / machine‑speed attacks) and its implications for incident response and Zero Trust priorities
• Strong expertise in:
• Cyber Security Incident Response coordination and program maturity
• Security Operations / CSIRT environments
• Zero Trust implementation (not just strategy)
• Identity and Access Management (IAM) as a core Zero Trust pillar
• Network security principles supporting Zero Trust architectures
• Demonstrated ability to:
• Assess environments and identify control gaps, particularly in identity and access
• Implement and operationalise security technologies, ensuring adoption into daily operations
• Translate Zero Trust concepts into practical, measurable solutions
• Develop policies, procedures, playbooks, and standards
• Produce high‑quality reporting and executive communications
• Solid understanding of:
• Incident response lifecycle (aligned to NIST (National Institute of Standards and Technology) or industry standards)
• Modern cyber threat landscape and attack vectors

Core competencies:

• Strong communication and stakeholder management skills (internal and external)
• Ability to operate in high‑pressure incident environments
• Analytical thinking and structured problem‑solving
• Ability to bridge technical teams and leadership audiences
• Strong focus on execution, delivery, and measurable outcomes

Required Experience:

1. Cyber Security Incident Response (CSIRT) Experience
   • Demonstrated experience in coordinating and managing cyber incidents (not just participating)
   • Experience working in CSIRT/SOC environments
   • Involvement in incident lifecycle (triage, coordination, recovery, post‑incident reviews)
   • Experience supporting cross‑functional and external stakeholder engagement during incidents
2. Cyber Security Incident Response - Communication, Reporting & Program Maturity
   • Proven ability to communicate effectively during incident situations, including with external stakeholders
   • Strong experience in developing incident reports, executive briefings, and communications
   • Experience building or improving procedures, playbooks, policies, and standards
   • Demonstrated contribution to program maturity, governance, and process improvement, including awareness of AI‑driven threats and experience aligning incident response / Zero Trust work to broader program workstreams
3. Zero Trust Implementation (Hands‑On Delivery)
   • Proven hands‑on experience implementing Zero Trust technologies, especially in identity and access management (IAM)
   • Ability to identify gaps in identity, access, and security architecture
   • Experience translating Zero Trust concepts into operational controls and outcomes
   • Demonstrated involvement in implementation—not just strategy or design
4. Identity & Network Security Expertise (Zero Trust Enablers)
   • Strong experience with identity security controls (MFA, Conditional Access, RBAC, PAM/PIM, Entra ID)
   • Working knowledge of network security aligned to Zero Trust (segmentation, secure access models, ZTNA)
   • Experience integrating identity and network controls into operational environments

Additional Deliverables:

Deliverables are not limited to the above and may evolve based on:

• Organisational priorities
• Emerging threats or incident activity
• Maturity needs across CSIRT and Zero Trust initiatives

The resource is expected to adapt to changing requirements and contribute broadly to:

• Cyber security program maturity
• Operational effectiveness and resilience
• Alignment to the AI‑Driven Risk Mitigation Program
• Ensure CSIRT and Zero Trust deliverables are consistent with, and reference, the relevant workstreams within the workstream program
• Where applicable, provide input into workstreams tied to identity, access, and Zero Trust controls (e.g., securing external doors, legacy / Zero‑Trust modernization) and to incident‑response acceleration for AI‑era threats
• Contribute to reporting that connects incident response and Zero Trust progress to the programme’s overall risk‑reduction objectives

Deliverables:

Cyber Security Incident Response (CSIRT) Program

• Mature the CSIRT Program
• Review, update, and enhance Incident Response (IR) standards, policies, procedures, and playbooks
• Document and standardise end‑to‑end incident response workflows across internal teams
• Work with internal stakeholders and external partners to align workflows, clarify roles/responsibilities, and improve coordination
• Ensure alignment with industry standards (e.g., NIST) and organisational requirements

Support CSIRT Operations

• Act as a lead responder / coordinator for:
• Confirmed internal security incidents
• Large‑scale or high‑impact external cyber security incidents affecting the sector
• Lead incident coordination, stakeholder communication, and reporting activities
• Produce incident reports, executive briefings, and communication artefacts
• Conduct and document post‑incident reviews (lessons learned) and track improvement actions

Enhance Communication & Reporting

• Establish or refine incident communication protocols, including external stakeholder engagement
• Develop standardised reporting templates and communication materials (e.g., SITREPs, executive summaries)

Zero Trust Implementation Current‑State Assessment & Gap Analysis

• Work with internal teams to assess the current security posture, with a focus on:
• Identity and access management controls
• Network security posture (segmentation, access models)
• Identify and document gaps against the defined Zero Trust framework and architecture

Tactical Implementation Planning

• Develop a practical, prioritised implementation plan to address identified gaps
• Focus on key Zero Trust pillars, particularly:
• Identity (e.g., MFA, Conditional Access, privileged access)
• Network security (e.g., segmentation, secure access models)

Hands‑On Implementation & Operationalisation

• Support and/or lead implementation of Zero Trust‑aligned technologies
• Work directly with technical teams to configure, integrate, and operationalise solutions
• Ensure controls are embedded into day‑to‑day operations and delivering measurable outcomes

Standards & Integration

• Develop and refine Zero Trust standards, implementation patterns, and guidance
• Ensure alignment and integration across identity, endpoint, and network security domains