Job DescriptionJob Description:Job Title: Security Architect - Senior for Cyber SecurityLocation: Toronto, ON Hybrid (3 days on-site)Duration: 9+ MonthsClient: BPS Ontario DescriptionBackground Information:The purpose of this request is to onboard a contingent cyber security resource to support the Director, Cyber Security Defence & Resilience, with both operational and strategic initiatives across the Agency and the broader health sector.This role will focus on two primary areas:Cyber Security Incident Response (CSIR): Enhancing program maturity, strengthening governance, and supporting the coordination of day-to-day cyber security incidents across the Agency and the health sector. A strong emphasis will be placed on communication, stakeholder engagement (including external audiences), and high-quality reporting, along with the development of procedures, policies, and standards.Zero Trust Implementation: Supporting the hands-on implementation and operationalization of Zero Trust principles and technologies across the enterprise. This includes assessing current security architecture, identifying gaps in identity, access, and network security controls, and working closely with Cyber Security Defence(CSD), Information Security Office (ISO), and operational teams to implement practical, integrated solutions.This role is not deeply technical (e.g., digital forensics), but requires a strong background and hands-on in CSIRT/Security Operations and Zero Trust implementation to ensure delivery of real, measurable outcomes and an operational Zero Trust model.This engagement sits within Agency's broader AI-Driven Risk Program and mitigation plan, established in response to the rapid rise of adversarial AI capabilities that are increasing the volume, speed, and complexity of cyber attacks across the health sector. The plan is being executed through serval workstreams spanning “Prevent & Reduce Exposure,” “Detect, Contain & Respond,” and “Outpace the Adversary.” While this role is focused primarily on Cyber Security Incident Response and Zero Trust implementation, the resource is expected to align their work to, and support the relevant workstreams — recognizing that Zero Trust and incident response are central enablers of the organization's ability to defend at machine speed. Responsibilities:CSIRT (Cyber Security Incident Response Team):Lead program maturity initiatives, including:· Developing and maintaining incident response procedures, playbooks, policies, and standards· Establishing and improving incident response governance, processes, and workflows· Defining KPIs, metrics, and reporting for program effectiveness· Supporting tabletop exercises and simulation activities Collaborate with stakeholders across the Agency and the health sector to:· Support coordinated incident response and communication· Provide advisory support during sector-wide cyber incidents· Promote cyber resilience and standardized security practices· Support incident response readiness for AI-accelerated / machine-speed threats, including faster containment and “breach vs. break” decision playbooks Support and enhance the Cyber Security Incident Response program, including:· Coordinating cyber incident response activities across internal teams and external stakeholders· Acting as a key point of contact for incident communications, including engagement with external partners and sector organizations· Developing incident reports, executive briefings, and communication materials· Supporting incident response activities (non-forensic), leveraging CSIRT/SOC experience Zero-TrustDrive practical integration across domains, including:· Translating Zero Trust principles into enforceable controls, processes, and standards· Supporting alignment across identity, endpoint, and network security components· Bridging strategy, architecture, and day-to-day operations· Align Zero Trust and identity work to the program's workstreams — particularly legacy modernization & Zero-Trust controls, Securing external doors (MFA/Conditional Access), and accelerated vulnerability remediation — contributing to these efforts at a supporting level Support and deliver Zero Trust implementation, including:· Assessing current-state architecture and identifying gaps in identity, access, and network security controls· Supporting or leading hands-on implementation of Zero Trust-aligned technologies, particularly in identity· Working closely with technical teams to configure, integrate, and operationalize security solutions· Ensuring Zero Trust capabilities are embedded into operational practices, not just deployed Desired Skills:· Experience in healthcare or public sector environments,



particularly Ontario health sector· Familiarity with regulatory and security frameworks (e.g., PHIPA, NIST CSF, ISO 27001)· Experience supporting cross-organizational incident response coordination· Experience implementing Conditional Access, PAM/PIM (Privileged Access Management/Privileged Identity Management), or identity governance solutions· Exposure to Zero Trust maturity models or assessments· Knowledge of cloud security environments· Experience with network micro-segmentation or Zero Trust Network Access (ZTNA)· Experience with SOAR (Security Orchestration Automation and Response) platforms or automation of incident workflows· Relevant certifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer)· Familiarity with defending against AI-driven / adversarial-AI threats and machine-speed attack techniques· Exposure to program-delivery models where security work is organized into coordinated workstreams (e.g., attack-surface reduction, CTEM, AI-enabled detection) Required Skills:· Minimum 7–10 years of experience in cyber security, with strong exposure to Incident Response / Security Operations (CSIRT/SOC)· Proven experience coordinating and managing cyber incidents, including communication with internal and external stakeholders· Strong ability to produce clear, concise reports, executive briefings, and incident communications· Experience developing incident response procedures, policies, standards, and playbooks· Proven hands-on experience implementing Zero Trust technologies, particularly in identity and access management (IAM)· Demonstrated ability to assess security environments and identify gaps, especially across identity and network security domains· Strong experience with identity-focused controls (e.g., MFA, Conditional Access, identity governance, privileged access)· Practical experience translating Zero Trust concepts into operational controls and measurable outcomes· Experience working with Microsoft security ecosystem (e.g., Defender, Sentinel, Entra ID) and AWS security ecosystem (e.g., Guard Duty, Security Hub,· Solid understanding of network security concepts aligned to Zero Trust (e.g., segmentation, secure access models)· Excellent written and verbal communication skills, including executive-level engagement· Working awareness of the up-to-date AI-driven threat landscape (e.g., AI-accelerated exploitation, automated / machine-speed attacks) and its implications for incident response and Zero Trust priorities Strong expertise in:· Cyber Security Incident Response coordination and program maturity· Security Operations / CSIRT environments· Zero Trust implementation (not just strategy)· Identity and Access Management (IAM) as a core Zero Trust pillar· Network security principles supporting Zero Trust architectures Demonstrated ability to:· Assess environments and identify control gaps, particularly in identity and access· Implement and operationalize security technologies, ensuring adoption into daily operations· Translate Zero Trust concepts into practical, measurable solutions· Develop policies, procedures, playbooks, and standards· Produce high-quality reporting and executive communications Solid understanding of:· Incident response lifecycle (aligned to NIST (National Institute of Standards and Technology) or industry standards)· Modern cyber threat landscape and attack vectors Core competencies:· Strong communication and stakeholder management skills (internal and external)· Ability to operate in high-pressure incident environments· Analytical thinking and structured problem-solving· Ability to bridge technical teams and leadership audiences· Strong focus on execution, delivery, and measurable outcomes Additional Deliverables · Deliverables are not limited to the above and may evolve based on:o Organizational prioritieso Emerging threats or incident activityo Maturity needs across CSIRT and Zero Trust initiatives · The resource is expected to adapt to changing requirements and contribute broadly to:o Cyber security program maturityo Operational effectiveness and resilience · Alignment to the AI-Driven Risk Mitigation Programo Ensure CSIRT and Zero Trust deliverables are consistent with, and reference, the relevant workstreams within the workstream programo Where applicable, provide input into workstreams tied to identity, access, and Zero Trust controls (e.g., securing external doors, legacy / Zero-Trust modernization)



and to incident-response acceleration for AI-era threatso Contribute to reporting that connects incident response and Zero Trust progress to the program's overall risk-reduction objectives DeliverablesCyber Security Incident Response (CSIRT) ProgramMature the CSIRT ProgramReview, update, and enhance Incident Response (IR) standards, policies, procedures, and playbooksDocument and standardize end-to-end incident response workflows across internal teamsWork with internal stakeholders and external partners to align workflows, clarify roles/responsibilities, and improve coordinationEnsure alignment with industry standards (e.g., NIST) and organizational requirementsSupport CSIRT Operations Act as a lead responder / coordinator for:Confirmed internal security incidentsLarge-scale or high-impact external cyber security incidents affecting the sectorLead incident coordination, stakeholder communication, and reporting activitiesProduce incident reports, executive briefings, and communication artifactsConduct and document post-incident reviews (lessons learned) and track improvement actionsEnhance Communication & ReportingEstablish or refine incident communication protocols, including external stakeholder engagementDevelop standardized reporting templates and communication materials (e.g., SITREPs, executive summaries)Zero Trust ImplementationCurrent-State Assessment & Gap AnalysisWork with internal teams to assess the current security posture, with a focus on:Identity and access management controlsNetwork security posture (segmentation, access models)Identify and document gaps against the defined Zero Trust framework and architectureTactical Implementation PlanningDevelop a practical, prioritized implementation plan to address identified gapsFocus on key Zero Trust pillars, particularly:Identity (e.g., MFA, Conditional Access, privileged access)Network security (e.g., segmentation, secure access models)Hands-On Implementation & OperationalizationSupport and/or lead implementation of Zero Trust-aligned technologiesWork directly with technical teams to configure, integrate, and operationalize solutionsEnsure controls are embedded into day-to-day operations and delivering measurable outcomesStandards & IntegrationDevelop and refine Zero Trust standards, implementation patterns, and guidanceEnsure alignment and integration across identity, endpoint, and network security domains 1 Knowledge Transfer· The resource will ensure comprehensive and continuous knowledge transfer to the Agency team throughout the duration of the engagement, with a formal transition period prior to contract completion. Knowledge transfer will not be deferred solely to the end of the engagement, but conducted on an ongoing basis as information is developed and consolidated. · The resource must provide and maintain complete, up-to-date documentation, including but not limited to:o Incident Response standards, policies, procedures, and playbookso Documented workflows (internal and external coordination)o Incident communication templates and reporting materialso Zero Trust assessments, gap analysis, and implementation planso Configuration and operational guidance for implemented technologies (identity and network) · All documentation will be reviewed with appropriate team leads and formally validated and approved by the manager/director to ensure accuracy, completeness, and usability. · The resource will work collaboratively with internal teams to ensure:o Knowledge sharing is embedded in day-to-day activitieso Key deliverables, milestones, and decisions are communicated and understoodo Internal staff are enabled to independently operate and sustain the processes and solutions implemented · The resource will conduct structured knowledge transfer sessions, including:o Walkthroughs of Incident Response processes and workflowso Briefings on incident coordination practices and communication protocolso Deep dives into Zero Trust implementation decisions, configurations, and operational models · A formal transition / handover plan must be developed and executed prior to the end of the engagement, including:o Identification of knowledge owners within the Agency teamo Transition of operational responsibilitieso Confirmation that all key processes and controls are fully operational and understood · The resource will provide walkthroughs and demonstrations of any implemented solutions, including:o Technology configurations (e.g., identity and access controls, network security controls)o Integration points and dependencieso Operational procedures required to maintain and support the solutions · Success of knowledge transfer will be measured by:o The Agency team's ability to execute incident response processes independentlyo The Agency's ability to maintain and operate Zero Trust controls w

📌 Security Architect - Senior for Cyber Security - Toronto, ON Hybrid (3 days on-site)
🏢 CareerBeacon
📍 Toronto