Cyber Security Incident Response (CSIR): Enhancing program maturity strengthening governance and supporting the coordination of day-to-day cyber security incidents across the Agency and the health sector. A strong emphasis will be placed on communication stakeholder engagement (including external audiences) and high-quality reporting along with the development of procedures policies and standards.
Zero Trust Implementation: Supporting the hands-on implementation and operationalization of Zero Trust principles and technologies across the enterprise. This includes assessing current security architecture identifying gaps in identity access and network security controls and working closely with Cyber Security Defence(CSD) Information Security Office (ISO) and operational teams to implement practical integrated solutions.
This role is not deeply technical (e.g. digital forensics) but requires a strong background and hands-on in CSIRT/Security Operations and Zero Trust implementation to ensure delivery of real measurable outcomes and an operational Zero Trust model.
This engagement sits within Agencys broader AI-Driven Risk Program and mitigation plan established in response to the rapid rise of adversarial AI capabilities that are increasing the volume speed and complexity of cyber attacks across the health sector. The plan is being executed through serval workstreams spanning Prevent & Reduce Exposure Detect Contain & Respond and Outpace the Adversary. While this role is focused primarily on Cyber Security Incident Response and Zero Trust implementation the resource is expected to align their work to and support the relevant workstreams recognizing that Zero Trust and incident response are central enablers of the organizations ability to defend at machine speed.
Responsibilities:
CSIRT (Cyber Security Incident Response Team):
Lead program maturity initiatives including:
- Developing and maintaining incident response procedures playbooks policies and standards
- Establishing and improving incident response governance processes and workflows
- Defining KPIs metrics and reporting for program effectiveness
- Supporting tabletop exercises and simulation activities
Collaborate with stakeholders across the Agency and the health sector to:
- Support coordinated incident response and communication
- Provide advisory support during sector-wide cyber incidents
- Promote cyber resilience and standardized security practices
- Support incident response readiness for AI-accelerated / machine-speed threats including faster containment and breach vs. break decision playbooks
Support and enhance the Cyber Security Incident Response program including:
- Coordinating cyber incident response activities across internal teams and external stakeholders
- Acting as a key point of contact for incident communications including engagement with external partners and sector organizations
- Developing incident reports executive briefings and communication materials
Drive practical integration across domains including:
- Translating Zero Trust principles into enforceable controls processes and standards
- Supporting alignment across identity endpoint and network security components
- Bridging strategy architecture and day-to-day operations
- Align Zero Trust and identity work to the programs workstreams particularly legacy modernization & Zero-Trust controls Securing external doors (MFA/Conditional Access) and accelerated vulnerability remediation contributing to these efforts at a supporting level
Support and deliver Zero Trust implementation including:
- Assessing current-state architecture and identifying gaps in identity access and network security controls
- Supporting or leading hands-on implementation of Zero Trust-aligned technologies particularly in identity
- Working closely with technical teams to configure integrate and operationalize security solutions
- Ensuring Zero Trust capabilities are embedded into operational practices not just deployed
Desired Skills:
- Experience in healthcare or public sector environments particularly Ontario health sector
- Familiarity with regulatory and security frameworks (e.g. PHIPA NIST CSF ISO 27001)
- Familiarity with defending against AI-driven / adversarial-AI threats and machine-speed attack techniques
- Exposure to program-delivery models where security work is organized into coordinated workstreams (e.g. attack-surface reduction CTEM AI-enabled detection)
Required Skills:
- Minimum 710 years of experience in cyber security with strong exposure to Incident Response / Security Operations (CSIRT/SOC)
- Proven experience coordinating and managing cyber incidents including communication with internal and external stakeholders
- Strong ability to produce explicit concise reports executive briefings and incident communications
- Experience developing incident response procedures policies standards and playbooks
- Proven hands-on experience implementing Zero Trust technologies particularly in identity and access management (IAM)
- Demonstrated ability to assess security environments and identify gaps especially across identity and network security domains
- Practical experience translating Zero Trust concepts into operational controls and measurable outcomes
- Experience working with Microsoft security ecosystem (e.g. Defender Sentinel Entra ID) and AWS security ecosystem (e.g. Guard Duty Security Hub
- Solid understanding of network security concepts aligned to Zero Trust (e.g. segmentation secure access models)
- Excellent written and verbal communication skills including executive-level engagement
- Working awareness of the modern AI-driven threat landscape (e.g. AI-accelerated exploitation automated / machine-speed attacks) and its implications for incident response and Zero Trust priorities
Strong expertise in:
- Cyber Security Incident Response coordination and program maturity
- Security Operations / CSIRT environments
- Zero Trust implementation (not just strategy)
- Identity and Access Management (IAM) as a core Zero Trust pillar
- Network security principles supporting Zero Trust architectures
Demonstrated ability to:
- Assess environments and identify control gaps particularly in identity and access
- Implement and operationalize security technologies ensuring adoption into daily operations
- Translate Zero Trust concepts into practical measurable solutions
- Develop policies procedures playbooks and standards
- Produce high-quality reporting and executive communications
Solid understanding of:
- Incident response lifecycle (aligned to NIST (National Institute of Standards and Technology) or industry standards)
- Modern cyber threat landscape and attack vectors
Core competencies:
- Strong communication and stakeholder management skills (internal and external)
- Ability to operate in high-pressure incident environments
- Analytical thinking and structured problem-solving
- Ability to bridge technical teams and leadership audiences
- Strong focus on execution delivery and measurable outcomes
Requirements
Required Experience:
Security Incident Response (CSIRT) Experience
- Demonstrated experience in coordinating and managing cyber incidents (not just participating)
- Experience working in CSIRT/SOC environments
- Involvement in incident lifecycle (triage coordination recovery post-incident reviews)
- Experience supporting cross-functional and external stakeholder engagement during incidents
Security Incident Response - Communication Reporting & Program Maturity
- Proven ability to communicate effectively during incident situations including with external stakeholders
- Strong experience in developing incident reports executive briefings and communicationsExperience building or improving procedures playbooks policies and standards
- Demonstrated contribution to program maturity governance and process improvement including awareness of AI-driven threats and experience aligning incident response / Zero Trust work to broader program workstreams
Trust Implementation (Hands-On Delivery)
- Proven hands-on experience implementing Zero Trust technologies especially in identity and access management (IAM)
- Ability to identify gaps in identity access and security architecture
- Experience translating Zero Trust concepts into operational controls and outcomes
- Demonstrated involvement in implementationnot just strategy or design
- Working knowledge of network security aligned to Zero Trust (segmentation secure access models ZTNA)
- Experience integrating identity and network controls into operational environments
Additional Deliverables
Deliverables are not limited to the above and may evolve based on:
o Organizational priorities
o Emerging threats or incident activity
o Maturity needs across CSIRT and Zero Trust initiatives
The resource is expected to adapt to changing requirements and contribute broadly to:
o Cyber security program maturity
o Operational effectiveness and resilience
Alignment to the AI-Driven Risk Mitigation Program
o Ensure CSIRT and Zero Trust deliverables are consistent with and reference the relevant workstreams within the workstream program
o Where applicable provide input into workstreams tied to identity access and Zero Trust controls (e.g. securing external doors legacy / Zero-Trust modernization) and to incident-response acceleration for AI-era threats
o Contribute to reporting that connects incident response and Zero Trust progress to the programs overall risk-reduction objectives
Deliverables
Cyber Security Incident Response (CSIRT) Program
- Mature the CSIRT Program
- Review update and enhance Incident Response (IR) standards policies procedures and playbooks
- Document and standardize end-to-end incident response workflows across internal teams
- Work with internal stakeholders and external partners to align workflows clarify roles/responsibilities and improve coordination
- Ensure alignment with industry standards (e.g. NIST) and organizational requirements
- Support CSIRT Operations
- Act as a lead responder / coordinator for:
- Confirmed internal security incidents
- Large-scale or high-impact external cyber security incidents affecting the sector
- Lead incident coordination stakeholder communication and reporting activities
- Produce incident reports executive briefings and communication artifacts
- Conduct and document post-incident reviews (lessons learned) and track improvement actions
- Enhance Communication & Reporting
- Establish or refine incident communication protocols including external stakeholder engagement
- Develop standardized reporting templates and communication materials (e.g. SITREPs executive summaries)
Zero Trust Implementation
- Current-State Assessment & Gap Analysis
- Work with internal teams to assess the current security posture with a focus on:
- Identity and access management controls
- Support and/or lead implementation of Zero Trust-aligned technologies
- Work directly with technical teams to configure integrate and operationalize solutions
- Ensure controls are embedded into day-to-day operations and delivering measurable outcomes
- Standards & Integration
- Develop and refine Zero Trust standards implementation patterns and guidance
- Ensure alignment and integration across identity endpoint and network security domains
Must Haves:
Security Incident Response (CSIRT) Experience
- Demonstrated experience in coordinating and managing cyber incidents (not just participating)
- Experience working in CSIRT/SOC environments
- Involvement in incident lifecycle (triage coordination recovery post-incident reviews)
- Experience supporting cross-functional and external stakeholder engagement during incidents
Security Incident Response - Communication Reporting & Program Maturity
- Proven ability to communicate effectively during incident situations including with external stakeholders
- Strong experience in developing incident reports executive briefings and communicationsExperience building or improving procedures playbooks policies and standards
- Demonstrated contribution to program maturity governance and process improvement including awareness of AI-driven threats and experience aligning incident response / Zero Trust work to broader program workstreams
Trust Implementation (Hands-On Delivery)
- Proven hands-on experience implementing Zero Trust technologies especially in identity and access management (IAM)
- Ability to identify gaps in identity access and security architecture
- Experience translating Zero Trust concepts into operational controls and outcomes
- Demonstrated involvement in implementationnot just strategy or design