Security Architect
- Senior
- Pay Rate: Flexible
- Hybrid
-

Location:
Toronto, Ontario
- Contract Length: 8 Months

Responsibilities:
CSIRT (Cyber Security Incident Response Team):
- Lead program maturity initiatives, including:
- Developing and maintaining incident response procedures, playbooks, policies, and standards
- Establishing and improving incident response governance, processes, and workflows
- Defining KPIs, metrics, and reporting for program effectiveness
- Supporting tabletop exercises and simulation activities Collaborate with stakeholders across the Agency and the health sector to:
- Support coordinated incident response and communication
- Provide advisory support during sector-wide cyber incidents
- Promote cyber resilience and standardized security practices
- Support incident response readiness for AI-accelerated / machine-speed threats, including faster containment and “breach vs. break” decision playbooks Support and enhance the Cyber Security Incident Response program, including:
- Coordinating cyber incident response activities across internal teams and external stakeholders
- Acting as a key point of contact for incident communications, including engagement with external partners and sector organizations
- Developing incident reports, executive briefings, and communication materials
- Supporting incident response activities (non-forensic), leveraging CSIRT/SOC experience Zero-Trust Drive practical integration across domains, including:
- Translating Zero Trust principles into enforceable controls, processes, and standards
- Supporting alignment across identity, endpoint, and network security components
- Bridging strategy, architecture, and day-to-day operations




- Align Zero Trust and identity work to the program’s workstreams — particularly legacy modernization & Zero-Trust controls, Securing external doors (MFA/Conditional Access), and accelerated vulnerability remediation — contributing to these efforts at a supporting level Support and deliver Zero Trust implementation, including:
- Assessing current-state architecture and identifying gaps in identity, access, and network security controls
- Supporting or leading hands‑on implementation of Zero Trust‑aligned technologies, particularly in identity
- Working closely with technical teams to configure, integrate, and operationalise security solutions
- Ensuring Zero Trust capabilities are embedded into operational practices, not just deployed Desired

Skills:
- Experience in healthcare or public sector environments, particularly Ontario health sector
- Familiarity with regulatory and security frameworks (e.g., PHIPA, NIST CSF, ISO 27001)
- Experience supporting cross‑organisational incident response coordination
- Experience implementing Conditional Access, PAM/PIM (Privileged Access Management / Privileged Identity Management), or identity governance solutions
- Exposure to Zero Trust maturity models or assessments
- Knowledge of cloud security environments
- Experience with network micro‑segmentation or Zero Trust Network Access (ZTNA)
- Experience with SOAR (Security Orchestration Automation and Response) platforms or automation of incident workflows
- Relevant certifications (e.g., CISSP, CISM, GIAC,



Azure Security Engineer)
- Familiarity with defending against AI‑driven / adversarial‑AI threats and machine‑speed attack techniques
- Exposure to program‑delivery models where security work is organised into coordinated workstreams (e.g., attack‑surface reduction, CTEM, AI‑enabled detection) Required

Skills:
- Minimum 7–10 years of experience in cyber security, with strong exposure to Incident Response / Security Operations (CSIRT/SOC)
- Proven experience coordinating and managing cyber incidents, including communication with internal and external stakeholders
- Strong ability to produce clear, concise reports, executive briefings, and incident communications
- Experience developing incident response procedures, policies, standards, and playbooks
- Proven hands‑on experience implementing Zero Trust technologies, particularly in identity and access management (IAM)
- Demonstrated ability to assess security environments and identify gaps, especially across identity and network security domains
- Solid experience with identity‑focused controls (e.g., MFA, Conditional Access, identity governance, privileged access)
- Practical experience translating Zero Trust concepts into operational controls and measurable outcomes
- Experience working with Microsoft security ecosystem (e.g., Defender, Sentinel, Entra ID) and AWS security ecosystem (e.g., Guard Duty, Security Hub,
- Solid understanding of network security concepts aligned to Zero Trust (e.g., segmentation, secure access models)
- Excellent written and verbal communication skills, including executive‑level engagement
- Working awareness of the modern AI‑driven threat landscape (e.g., AI‑accelerated exploitation, automated / machi

📌 Security Architect (Toronto)
🏢 Ian Martin Group
📍 Toronto