The purpose of this request is to onboard a contingent cyber security resource to support the Director Cyber Security Defence & Resilience with operational and strategic initiatives across the Agency and the broader Ontario health sector.
This role sits within the Agencys broader AI-Driven Risk Program and mitigation plan established to counter rapid increases in adversarial AI and machine-speed cyber attacks. The resource will focus on two primary non-forensic areas:
Cyber Security Incident Response (CSIR): Enhancing program maturity governance day-to-day coordination and stakeholder communication.
Zero Trust Implementation: Assessing current security architecture and driving hands-on operationalization of identity access and network controls.
Responsibilities & Deliverables
Cyber Security Incident Response (CSIR) Program
Mature the Program: Review update and standardize incident response (IR) policies workflows procedures and playbooks in alignment with NIST standards.
Lead Coordination: Act as a lead responder and coordinator for confirmed internal and large-scale external cyber incidents affecting the healthcare sector.
Communications & Reporting: Build executive briefings situational reports (SITREPs) and incident summaries. Guide communications with internal teams and external healthcare stakeholders.
Performance & Readiness: Define KPIs track program metrics lead post-incident reviews and support tabletop simulation exercises. Adapt playbooks for AI-accelerated threats.
Zero Trust Implementation & Operationalization
Gap Analysis:
Assess current-state architecture to identify and document flaws in identity access and network security controls.
Hands-On Implementation: Lead the deployment configuration and integration of Zero Trust-aligned technologies alongside technical teams.
Process Embedding: Translate abstract Zero Trust concepts into measurable daily operational controls ensuring architecture patterns integrate cleanly across identity endpoint and network domains.
Required Skills & Experience
Experience: 710 years of dedicated experience in cyber security with strong exposure to CSIRT or SOC environments.
Incident Management: Proven experience leading and managing the full incident lifecycle including cross-functional and external stakeholder coordination under high-pressure conditions.
Zero Trust Delivery: Demonstrated hands-on implementation experience with Zero Trust frameworks specifically translating strategy into deployed infrastructure rather than just designing models.
Technical Toolsets: Robust working knowledge of the Microsoft security ecosystem (Entra ID Defender Sentinel) and AWS security tools (GuardDuty Security Hub).
Modern Threat Awareness: Solid understanding of the modern AI-driven threat landscape including machine-speed exploitation and attack vectors.