Security Architect - Senior

- Pay Rate: Flexible - Hybrid
- Location: Toronto, Ontario
- Contract Length: 8 Months

Responsibilities:

CSIRT (Cyber Security Incident Response Team):

- Lead program maturity initiatives, including:

- Developing and maintaining incident response procedures, playbooks, policies, and standards
- Establishing and improving incident response governance, processes, and workflows
- Defining KPIs, metrics, and reporting for program effectiveness
- Supporting tabletop exercises and simulation activities

Collaborate with stakeholders across the Agency and the health sector to:

- Support coordinated incident response and communication
- Provide advisory support during sector-wide cyber incidents
- Promote cyber resilience and standardized security practices
- Support incident response readiness for AI-accelerated / machine-speed threats, including faster containment and “breach vs. break” decision playbooks

Support and enhance the Cyber Security Incident Response program, including:

- Coordinating cyber incident response activities across internal teams and external stakeholders
- Acting as a key point of contact for incident communications, including engagement with external partners and sector organizations
- Developing incident reports, executive briefings, and communication materials
- Supporting incident response activities (non-forensic), leveraging CSIRT/SOC experience

Zero-Trust

Drive practical integration across domains, including:

- Translating Zero Trust principles into enforceable controls, processes, and standards
- Supporting alignment across identity, endpoint, and network security components
- Bridging strategy,



architecture, and day-to-day operations
- Align Zero Trust and identity work to the program’s workstreams — particularly legacy modernization & Zero-Trust controls, Securing external doors (MFA/Conditional Access), and accelerated vulnerability remediation — contributing to these efforts at a supporting level

Support and deliver Zero Trust implementation, including:

- Assessing current-state architecture and identifying gaps in identity, access, and network security controls
- Supporting or leading hands‑on implementation of Zero Trust‑aligned technologies, particularly in identity
- Working closely with technical teams to configure, integrate, and operationalise security solutions
- Ensuring Zero Trust capabilities are embedded into operational practices, not just deployed

Desired Skills:

- Experience in healthcare or public sector environments, particularly Ontario health sector
- Familiarity with regulatory and security frameworks (e.g., PHIPA, NIST CSF, ISO 27001)
- Experience supporting cross‑organisational incident response coordination
- Experience implementing Conditional Access, PAM/PIM (Privileged Access Management / Privileged Identity Management), or identity governance solutions
- Exposure to Zero Trust maturity models or assessments




- Knowledge of cloud security environments
- Experience with network micro‑segmentation or Zero Trust Network Access (ZTNA)
- Experience with SOAR (Security Orchestration Automation and Response) platforms or automation of incident workflows
- Relevant certifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer)
- Familiarity with defending against AI‑driven / adversarial‑AI threats and machine‑speed attack techniques
- Exposure to program‑delivery models where security work is organised into coordinated workstreams (e.g., attack‑surface reduction, CTEM, AI‑enabled detection)

Required Skills:

- Minimum 7–10 years of experience in cyber security, with strong exposure to Incident Response / Security Operations (CSIRT/SOC)
- Proven experience coordinating and managing cyber incidents, including communication with internal and external stakeholders
- Robust ability to produce clear, concise reports, executive briefings, and incident communications
- Experience developing incident response procedures, policies, standards, and playbooks
- Proven hands‑on experience implementing Zero Trust technologies, particularly in identity and access management (IAM)
- Demonstrated ability to assess security environments and identify gaps, especially across identity and network security domains
- Strong experience with identity‑focused controls (e.g., MFA, Conditional Access, identity governance, privileged access)
- Practical experience translating Zero Trust concepts into operational controls and measurable outcomes
- Experience wor

📌 Security Architect (Toronto)
🏢 Ian Martin Group
📍 Toronto