Assigned Recruiter(s) Madhumitha Mulakaluri
Job Opening ID 11772
City Toronto
Country Canada
Number of Positions 1
Work Experience 10+ Years

Job Description
This role will focus on two primary areas:

Cyber Security Incident Response (CSIR): Enhancing programmaturity, strengthening governance, and supporting the coordination ofday-to-day cyber security incidents across the Agency and the health sector. Astrong emphasis will be placed on communication, stakeholder engagement(including external audiences), and high-quality reporting, along with thedevelopment of procedures, policies, and standards.

Zero Trust Implementation: Supporting the hands-onimplementation and operationalization of Zero Trust principles and technologiesacross the enterprise. This includes assessing current security architecture,identifying gaps in identity, access, and network security controls, andworking closely with Cyber Security Defence(CSD), Information Security Office(ISO), and operational teams to implement practical, integrated solutions.

This role is not deeply technical (e.g., digital forensics),but requires a robust background and hands-on in CSIRT/Security Operations andZero Trust implementation to ensure delivery of real, measurable outcomes andan operational Zero Trust model.

This engagement sits within Agency’s broader AI-Driven RiskProgram and mitigation plan, established in response to the rapid rise ofadversarial AI capabilities that are increasing the volume, speed, andcomplexity of cyber attacks across the health sector. The plan is beingexecuted through serval workstreams spanning “Prevent & Reduce Exposure,”“Detect, Contain & Respond,” and “Outpace the Adversary.” While this roleis focused primarily on Cyber Security Incident Response and Zero Trustimplementation, the resource is expected to align their work to, and supportthe relevant workstreams — recognizing that Zero Trust and incident responseare central enablers of the organization’s ability to defend at machine speed.

Responsibilities:

CSIRT (Cyber Security Incident Response Team):

Lead program maturity initiatives, including:

Developingand maintaining incident response procedures, playbooks, policies, andstandards

Establishingand improving incident response governance, processes, and workflows

DefiningKPIs, metrics, and reporting for program effectiveness

Supportingtabletop exercises and simulation activities

Collaborate with stakeholders across the Agency and thehealth sector to:

Supportcoordinated incident response and communication

Provideadvisory support during sector-wide cyber incidents

Promotecyber resilience and standardized security practices

Supportincident response readiness for AI-accelerated / machine-speed threats,including faster containment and “breach vs. break” decision playbooks

Support and enhance the Cyber Security Incident Responseprogram, including:

Coordinatingcyber incident response activities across internal teams and externalstakeholders

Acting as akey point of contact for incident communications, including engagement withexternal partners and sector organizations

Developingincident reports, executive briefings, and communication materials

Supportingincident response activities (non-forensic), leveraging CSIRT/SOC experience

Zero-Trust

Drive practical integration across domains, including:

TranslatingZero Trust principles into enforceable controls, processes, and standards

Supportingalignment across identity, endpoint, and network security components

Bridgingstrategy, architecture, and day-to-day operations

Align ZeroTrust and identity work to the program’s workstreams — particularly legacymodernization & Zero-Trust controls, Securing external doors(MFA/Conditional Access), and accelerated vulnerability remediation —contributing to these efforts at a supporting level

Support and deliver Zero Trust implementation, including:

Assessingcurrent-state architecture and identifying gaps in identity, access, andnetwork security controls

Supportingor leading hands-on implementation of Zero Trust-aligned technologies,particularly in identity

Workingclosely with technical teams to configure, integrate, and operationalizesecurity solutions

EnsuringZero Trust capabilities are embedded into operational practices, not justdeployed

Desired Skills:

Experiencein healthcare or public sector environments, particularly Ontario health sector

Familiaritywith regulatory and security frameworks (e.g., PHIPA, NIST CSF, ISO 27001)

Experiencesupporting cross-organizational incident response coordination

Experienceimplementing Conditional Access, PAM/PIM (Privileged AccessManagement/Privileged Identity Management), or identity governance solutions

Exposure toZero Trust maturity models or assessments

Knowledgeof cloud security environments

Experiencewith network micro-segmentation or Zero Trust Network Access (ZTNA)

Experiencewith SOAR (Security Orchestration Automation and Response) platforms orautomation of incident workflows





Relevantcertifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer)

Familiaritywith defending against AI-driven / adversarial-AI threats and machine-speedattack techniques

Exposure toprogram-delivery models where security work is organized into coordinatedworkstreams (e.g., attack-surface reduction, CTEM, AI-enabled detection)

Required Skills:

Minimum7–10 years of experience in cyber security, with strong exposure to IncidentResponse / Security Operations (CSIRT/SOC)

Provenexperience coordinating and managing cyber incidents, including communicationwith internal and external stakeholders

Strongability to produce clear, concise reports, executive briefings, and incidentcommunications

Experiencedeveloping incident response procedures, policies, standards, and playbooks

Provenhands-on experience implementing Zero Trust technologies, particularly inidentity and access management (IAM)

Demonstratedability to assess security environments and identify gaps, especially acrossidentity and network security domains

Strongexperience with identity-focused controls (e.g., MFA, Conditional Access,identity governance, privileged access)

Practicalexperience translating Zero Trust concepts into operational controls andmeasurable outcomes

Experienceworking with Microsoft security ecosystem (e.g., Defender, Sentinel, Entra ID)and AWS security ecosystem (e.g., Guard Duty, Security Hub,

Solidunderstanding of network security concepts aligned to Zero Trust (e.g.,segmentation, secure access models)

Excellentwritten and verbal communication skills, including executive-level engagement

Workingawareness of the modern AI-driven threat landscape (e.g., AI-acceleratedexploitation, automated / machine-speed attacks) and its implications forincident response and Zero Trust priorities

Strong expertise in:

CyberSecurity Incident Response coordination and program maturity

SecurityOperations / CSIRT environments

Zero Trustimplementation (not just strategy)

Identityand Access Management (IAM) as a core Zero Trust pillar

Networksecurity principles supporting Zero Trust architectures

Demonstrated ability to:

Assessenvironments and identify control gaps, particularly in identity and access

Implementand operationalize security technologies, ensuring adoption into dailyoperations

TranslateZero Trust concepts into practical, measurable solutions

Developpolicies, procedures, playbooks, and standards

Producehigh-quality reporting and executive communications

Solid understanding of:

Incidentresponse lifecycle (aligned to NIST (National Institute of Standards andTechnology) or industry standards)

Moderncyber threat landscape and attack vectors

Core competencies:

Strongcommunication and stakeholder management skills (internal and external)

Ability tooperate in high-pressure incident environments

Analyticalthinking and structured problem-solving

Ability tobridge technical teams and leadership audiences

Strongfocus on execution, delivery, and measurable outcomes

Requirements
Required Experience:

1.Cyber Security Incident Response (CSIRT) Experience

Demonstrated experience in coordinating and managing cyber incidents (not just participating)

Experience working in CSIRT/SOC environments

Involvement in incident lifecycle (triage, coordination, recovery, post-incident reviews)

Experience supporting cross-functional and external stakeholder engagement during incidents

2.Cyber Security Incident Response -Communication, Reporting & Program Maturity

Proven ability to communicate effectively during incident situations, including with external stakeholders

Strong experience in developing incident reports, executive briefings, and communicationsExperience building or improving procedures, playbooks, policies, and standards

Demonstrated contribution to program maturity, governance, and process improvement, including awareness of AI-driven threats and experience aligning incident response / Zero Trust work to broader program workstreams

3.Zero Trust Implementation (Hands-On Delivery)

Proven hands-on experience implementing Zero Trust technologies, especially in identity and access management (IAM)

Ability to identify gaps in identity, access, and security architecture

Experience translating Zero Trust concepts into operational controls and outcomes

Demonstrated involvement in implementation—not just strategy or design

4.Identity & Network Security Expertise (Zero Trust Enablers)

Strong experience with identity security controls (MFA, Conditional Access, RBAC, PAM/PIM, Entra ID)





Working knowledge of network security aligned to Zero Trust (segmentation, secure access models, ZTNA)

Experience integrating identity and network controls into operational environments

Additional Deliverables

Deliverables are not limited to the above and may evolve based on:

o Organizational priorities

o Emerging threats or incident activity

o Maturity needs across CSIRT and Zero Trust initiatives

The resource is expected to adapt to changing requirements and contribute broadly to:

o Cyber security program maturity

o Operational effectiveness and resilience

Alignment to the AI-Driven Risk Mitigation Program

o Ensure CSIRT and Zero Trust deliverables are consistent with, and reference, the relevant workstreams within the workstream program

o Where applicable, provide input into workstreams tied to identity, access, and Zero Trust controls (e.g., securing external doors, legacy / Zero-Trust modernization) and to incident-response acceleration for AI-era threats

o Contribute to reporting that connects incident response and Zero Trust progress to the program’s overall risk-reduction objectives

Cyber Security Incident Response (CSIRT) Program

Mature the CSIRT Program Review, update, and enhance Incident Response (IR) standards, policies, procedures, and playbooks

Document and standardize end-to-end incident response workflows across internal teams

Work with internal stakeholders and external partners to align workflows, clarify roles/responsibilities, and improve coordination

Ensure alignment with industry standards (e.g., NIST) and organizational requirements

Support CSIRT Operations Act as a lead responder / coordinator for: Confirmed internal security incidents

Large-scale or high-impact external cyber security incidents affecting the sector

Lead incident coordination, stakeholder communication, and reporting activities

Produce incident reports, executive briefings, and communication artifacts

Conduct and document post-incident reviews (lessons learned) and track improvement actions

Enhance Communication & Reporting Establish or refine incident communication protocols, including external stakeholder engagement

Develop standardized reporting templates and communication materials (e.g., SITREPs, executive summaries)

Zero Trust Implementation

Current-State Assessment & Gap Analysis Work with internal teams to assess the current security posture, with a focus on: Identity and access management controls

Network security posture (segmentation, access models)

Identify and document gaps against the defined Zero Trust framework and architecture

Tactical Implementation Planning Develop a practical, prioritized implementation plan to address identified gaps

Focus on key Zero Trust pillars, particularly: Identity (e.g., MFA, Conditional Access, privileged access)

Network security (e.g., segmentation, secure access models)

Support and/or lead implementation of Zero Trust-aligned technologies

Work directly with technical teams to configure, integrate, and operationalize solutions

Ensure controls are embedded into day-to-day operations and delivering measurable outcomes

Standards & Integration Develop and refine Zero Trust standards, implementation patterns, and guidance

Ensure alignment and integration across identity, endpoint, and network security domains

Must Haves:

1.Cyber Security Incident Response (CSIRT) Experience

Demonstrated experience in coordinating and managing cyber incidents (not just participating)

Experience working in CSIRT/SOC environments

Involvement in incident lifecycle (triage, coordination, recovery, post-incident reviews)

Experience supporting cross-functional and external stakeholder engagement during incidents

2.Cyber Security Incident Response - Communication, Reporting & Program Maturity

Proven ability to communicate effectively during incident situations, including with external stakeholders

Strong experience in developing incident reports, executive briefings, and communicationsExperience building or improving procedures, playbooks, policies, and standards

Demonstrated contribution to program maturity, governance, and process improvement, including awareness of AI-driven threats and experience aligning incident response / Zero Trust work to broader program workstreams

3.Zero Trust Implementation (Hands-On Delivery)

Proven hands-on experience implementing Zero Trust technologies, especially in identity and access management (IAM)

Ability to identify gaps in identity, access, and security architecture

Experience translating Zero Trust concepts into operational controls and outcomes

Demonstrated involvement in implementation—not just strategy or design

4.Identity & Network Security Expertise (Zero Trust Enablers)

Strong experience with identity security controls (MFA, Conditional Access, RBAC, PAM/PIM, Entra ID)

Working knowledge of network security aligned to Zero Trust (segmentation, secure access models, ZTNA)

Experience integrating identity and network controls into operational environments

#J-18808-Ljbffr

📌 11772 (Ontario)
🏢 Maarut
📍 Ontario