Security Architect - Senior

Job Title: Security Architect - Senior

Duration: 8 months

Must Haves

• Minimum 7–10 years of experience in cyber security, with strong exposure to Incident Response / Security Operations (CSIRT/SOC)
• Proven experience coordinating and managing cyber incidents, including communication with internal and external stakeholders
• Strong ability to produce clear, concise reports, executive briefings, and incident communications
• Experience developing incident response procedures, policies, standards, and playbooks
• Proven hands-on experience implementing Zero Trust technologies, particularly in identity and access management (IAM)
• Demonstrated ability to assess security environments and identify gaps, especially across identity and network security domains
• Strong experience with identity-focused controls (e.g., MFA, Conditional Access, identity governance, privileged access)
• Practical experience translating Zero Trust concepts into operational controls and measurable outcomes
• Experience working with Microsoft security ecosystem (e.g., Defender, Sentinel, Entra ID) and AWS security ecosystem (e.g., Guard Duty, Security Hub,
• Solid understanding of network security concepts aligned to Zero Trust (e.g., segmentation, secure access models)
• Excellent written and verbal communication skills, including executive-level engagement
• Working awareness of the modern AI-driven threat landscape (e.g., AI-accelerated exploitation, automated / machine-speed attacks) and its implications for incident response and Zero Trust priorities

Description / Responsibilities / Skills

Project Description

• onboard a contingent cyber security resource to support the Director, Cyber Security Defence & Resilience, with both operational and strategic initiatives across the Agency and the broader health sector.
• Supporting the hands-on implementation and operationalization of Zero Trust principles and technologies across the enterprise.
• working closely with Cyber Security Defence(CSD), Information Security Office (ISO), and operational teams to implement practical, integrated solutions.
• This role is not deeply technical (e.g., digital forensics)

CSIRT (Cyber Security Incident Response Team):

• Defining KPIs, metrics, and reporting for program effectiveness
• Supporting tabletop exercises and simulation activities
• Provide advisory support during sector-wide cyber incidents
• Promote cyber resilience and standardized security practices
• Support incident response readiness for AI-accelerated / machine-speed threats, including faster containment and “breach vs. break” decision playbooks
• Supporting incident response activities (non-forensic), leveraging CSIRT/SOC experience

Zero-Trust

• Supporting alignment across identity, endpoint, and network security components
• Bridging strategy, architecture, and day-to-day operations
• Align Zero Trust and identity work to the program's workstreams — particularly legacy modernization & Zero-Trust controls, Securing external doors (MFA/Conditional Access), and accelerated vulnerability remediation — contributing to these efforts at a supporting level
• Working closely with technical teams to configure, integrate, and operationalize security solutions
• Ensuring Zero Trust capabilities are embedded into operational practices, not just deployed

Additional Deliverables

• Ensure CSIRT and Zero Trust deliverables are consistent with, and reference, the relevant workstreams within the workstream program
• Contribute to reporting that connects incident response and Zero Trust progress to the program's overall risk-reduction objectives
• The resource is expected to adapt to changing requirements and contribute broadly to:

Deliverables

• Mature the CSIRT Program
• Document and standardize end-to-end incident response workflows across internal teams
• Work with internal stakeholders and external partners to align workflows, clarify roles/responsibilities, and improve coordination
• Ensure alignment with industry standards (e.g., NIST) and organizational requirements
• Support CSIRT Operations
• Act as a lead responder / coordinator for:
• Confirmed internal security incidents
• Large-scale or high-impact external cyber security incidents affecting the sector

Experience & Skill Set Requirements

Desired Skills

• Experience in healthcare or public sector environments, particularly Ontario health sector
• Familiarity with regulatory and security frameworks (e.g., PHIPA, NIST CSF, ISO 27001)
• Exposure to Zero Trust maturity models or assessments
• Knowledge of cloud security environments
• Experience with network micro-segmentation or Zero Trust Network Access (ZTNA)
• Experience with SOAR (Security Orchestration Automation and Response) platforms or automation of incident workflows
• Relevant certifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer)
• Familiarity with defending against AI-driven / adversarial-AI threats and machine-speed attack techniques
• Exposure to program-delivery models where security work is organized into coordinated workstreams (e.g., attack-surface reduction, CTEM, AI-enabled detection)

Required Skills

• Experience working with Microsoft security ecosystem (e.g., Defender, Sentinel, Entra ID) and AWS security ecosystem (e.g., Guard Duty,
• Working awareness of the modern AI-driven threat landscape (e.g., AI-accelerated exploitation, automated / machine-speed attacks) and its implications

Strong expertise in:

• Network security principles supporting Zero Trust architectures

Demonstrated ability to:

• Implement and operationalize security technologies, ensuring adoption into daily operations

Solid understanding of:

• Incident response lifecycle (aligned to NIST (National Institute of Standards and Technology) or industry standards)
• Modern cyber threat landscape and attack vectors

Core competencies:

• Ability to operate in high-pressure incident environments
• Analytical thinking and structured problem-solving
• Ability to bridge technical teams and leadership audiences
• Strong focus on execution, delivery, and measurable outcomes

1.Cyber Security Incident Response (CSIRT) Experience

• Involvement in incident lifecycle (triage, coordination, recovery, post-incident reviews)

2.Cyber Security Incident Response - Communication, Reporting & Program Maturity

• Demonstrated contribution to program maturity, governance, and process improvement, including awareness of AI-driven threats and experience aligning incident response / Zero Trust work to broader program workstreams

4.Identity & Network Security Expertise (Zero Trust Enablers)

• Working knowledge of network security aligned to Zero Trust (segmentation, secure access models, ZTNA)
• Experience integrating identity and network controls into operational environments