Security Architect - SeniorPay Rate: Versatile - HybridLocation: Toronto, OntarioContract Length: 8 MonthsResponsibilities:CSIRT (Cyber Security Incident Response Team):Lead program maturity initiatives, including:Developing and maintaining incident response procedures, playbooks, policies, and standardsEstablishing and improving incident response governance, processes, and workflowsDefining KPIs, metrics, and reporting for program effectivenessSupporting tabletop exercises and simulation activitiesCollaborate with stakeholders across the Agency and the health sector to:Support coordinated incident response and communicationProvide advisory support during sector-wide cyber incidentsPromote cyber resilience and standardized security practicesSupport incident response readiness for AI-accelerated / machine-speed threats, including faster containment and “breach vs. break” decision playbooksSupport and enhance the Cyber Security Incident Response program, including:Coordinating cyber incident response activities across internal teams and external stakeholdersActing as a key point of contact for incident communications, including engagement with external partners and sector organizationsDeveloping incident reports, executive briefings, and communication materialsSupporting incident response activities (non-forensic), leveraging CSIRT/SOC experienceZero-TrustDrive practical integration across domains, including:Translating Zero Trust principles into enforceable controls, processes, and standardsSupporting alignment across identity, endpoint, and network security componentsBridging strategy, architecture, and day-to-day operationsAlign Zero Trust and identity work to the program’s workstreams — particularly legacy modernization & Zero-Trust controls, Securing external doors (MFA/Conditional Access), and accelerated vulnerability remediation — contributing to these efforts at a supporting levelSupport and deliver Zero Trust implementation, including:Assessing current-state architecture and identifying gaps in identity, access, and network security controlsSupporting or leading hands‑on implementation of Zero Trust‑aligned technologies, particularly in identityWorking closely with technical teams to configure, integrate, and operationalise security solutionsEnsuring Zero Trust capabilities are embedded into operational practices, not just deployedDesired Skills:Experience in healthcare or public sector environments, particularly Ontario health sectorFamiliarity with regulatory and security frameworks (e.G., PHIPA, NIST CSF, ISO 27001)Experience supporting cross‑organisational incident response coordinationExperience implementing Conditional Access, PAM/PIM (Privileged Access Management / Privileged Identity Management), or identity governance solutionsExposure to Zero Trust maturity models or assessmentsKnowledge of cloud security environmentsExperience with network micro‑segmentation or Zero Trust Network Access (ZTNA)Experience with SOAR (Security Orchestration Automation and Response) platforms or automation of incident workflowsRelevant certifications (e.G., CISSP, CISM, GIAC, Azure Security Engineer)Familiarity with defending against AI‑driven / adversarial‑AI threats and machine‑speed attack techniquesExposure to program‑delivery models where security work is organised into coordinated workstreams (e.G., attack‑surface reduction, CTEM, AI‑enabled detection)Required Skills:Minimum 7–10 years of experience in cyber security, with strong exposure to Incident Response / Security Operations (CSIRT/SOC)Proven experience coordinating and managing cyber incidents, including communication with internal and external stakeholdersStrong ability to produce clear, concise reports, executive briefings, and incident communicationsExperience developing incident response procedures, policies, standards, and playbooksProven hands‑on experience implementing Zero Trust technologies, particularly in identity and access management (IAM)Demonstrated ability to assess security environments and identify gaps,



especially across identity and network security domainsStrong experience with identity‑focused controls (e.G., MFA, Conditional Access, identity governance, privileged access)Practical experience translating Zero Trust concepts into operational controls and measurable outcomesExperience working with Microsoft security ecosystem (e.G., Defender, Sentinel, Entra ID) and AWS security ecosystem (e.G., Guard Duty, Security Hub,Solid understanding of network security concepts aligned to Zero Trust (e.G., segmentation, secure access models)Excellent written and verbal communication skills, including executive‑level engagementWorking awareness of the modern AI‑driven threat landscape (e.G., AI‑accelerated exploitation, automated / machine‑speed attacks) and its implications for incident response and Zero Trust prioritiesStrong expertise in:Cyber Security Incident Response coordination and program maturitySecurity Operations / CSIRT environmentsZero Trust implementation (not just strategy)Identity and Access Management (IAM) as a core Zero Trust pillarNetwork security principles supporting Zero Trust architecturesDemonstrated ability to:Assess environments and identify control gaps, particularly in identity and accessImplement and operationalise security technologies, ensuring adoption into daily operationsTranslate Zero Trust concepts into practical, measurable solutionsDevelop policies, procedures, playbooks, and standardsProduce high‑quality reporting and executive communicationsSolid understanding of:Incident response lifecycle (aligned to NIST (National Institute of Standards and Technology) or industry standards)Modern cyber threat landscape and attack vectorsCore competencies:Strong communication and stakeholder management skills (internal and external)Ability to operate in high‑pressure incident environmentsAnalytical thinking and structured problem‑solvingAbility to bridge technical teams and leadership audiencesStrong focus on execution, delivery, and measurable outcomesRequired Experience:1. Cyber Security Incident Response (CSIRT) ExperienceDemonstrated experience in coordinating and managing cyber incidents (not just participating)Experience working in CSIRT/SOC environmentsInvolvement in incident lifecycle (triage, coordination, recovery, post‑incident reviews)Experience supporting cross‑functional and external stakeholder engagement during incidents2. Cyber Security Incident Response - Communication, Reporting & Program MaturityProven ability to communicate effectively during incident situations, including with external stakeholdersStrong experience in developing incident reports, executive briefings, and communications Experience building or improving procedures, playbooks, policies, and standardsDemonstrated contribution to program maturity, governance, and process improvement, including awareness of AI‑driven threats and experience aligning incident response / Zero Trust work to broader program workstreams3. Zero Trust Implementation (Hands‑On Delivery)Proven hands‑on experience implementing Zero Trust technologies, especially in identity and access management (IAM)Ability to identify gaps in identity, access, and security architectureExperience translating Zero Trust concepts into operational controls and outcomesDemonstrated involvement in implementation—not just strategy or design4. Identity & Network Security Expertise (Zero Trust Enablers)Strong experience with identity security controls (MFA, Conditional Access, RBAC, PAM/PIM, Entra ID)Working knowledge of network security aligned to Zero Trust (segmentation, secure access models,



ZTNA)Experience integrating identity and network controls into operational environmentsAdditional Deliverables:Deliverables are not limited to the above and may evolve based on:Organisational prioritiesEmerging threats or incident activityMaturity needs across CSIRT and Zero Trust initiativesThe resource is expected to adapt to changing requirements and contribute broadly to:Cyber security program maturityOperational effectiveness and resilienceAlignment to the AI‑Driven Risk Mitigation ProgramEnsure CSIRT and Zero Trust deliverables are consistent with, and reference, the relevant workstreams within the workstream programWhere applicable, provide input into workstreams tied to identity, access, and Zero Trust controls (e.G., securing external doors, legacy / Zero‑Trust modernization) and to incident‑response acceleration for AI‑era threatsContribute to reporting that connects incident response and Zero Trust progress to the programme’s overall risk‑reduction objectivesDeliverables:Cyber Security Incident Response (CSIRT) ProgramMature the CSIRT ProgramReview, update, and enhance Incident Response (IR) standards, policies, procedures, and playbooksDocument and standardise end‑to‑end incident response workflows across internal teamsWork with internal stakeholders and external partners to align workflows, clarify roles/responsibilities, and improve coordinationEnsure alignment with industry standards (e.G., NIST) and organisational requirementsSupport CSIRT OperationsAct as a lead responder / coordinator for:Confirmed internal security incidentsLarge‑scale or high‑impact external cyber security incidents affecting the sectorLead incident coordination, stakeholder communication, and reporting activitiesProduce incident reports, executive briefings, and communication artefactsConduct and document post‑incident reviews (lessons learned) and track improvement actionsEnhance Communication & ReportingEstablish or refine incident communication protocols, including external stakeholder engagementDevelop standardised reporting templates and communication materials (e.G., SITREPs, executive summaries)Zero Trust ImplementationCurrent‑State Assessment & Gap AnalysisWork with internal teams to assess the current security posture, with a focus on:Identity and access management controlsNetwork security posture (segmentation, access models)Identify and document gaps against the defined Zero Trust framework and architectureTactical Implementation PlanningDevelop a practical, prioritised implementation plan to address identified gapsFocus on key Zero Trust pillars, particularly:Identity (e.G., MFA, Conditional Access, privileged access)Network security (e.G., segmentation, secure access models)Hands‑On Implementation & OperationalisationSupport and/or lead implementation of Zero Trust‑aligned technologiesWork directly with technical teams to configure, integrate, and operationalise solutionsEnsure controls are embedded into day‑to‑day operations and delivering measurable outcomesStandards & IntegrationDevelop and refine Zero Trust standards, implementation patterns, and guidanceEnsure alignment and integration across identity, endpoint, and network security domainsLooking for meaningful work? We can help!Raise is an established hiring firm with over 65 years of experience. We believe strongly in making the world a better place through work, which is why we’re a certified B Corporation and donate 10% of our profits to charity.We strive to build teams that reflect the diversity of the communities we work in. We encourage all qualified applicants to apply, including people from traditionally under‑represented groups such as women, visible minorities, Indigenous peoples, people identifying as LGBTQ2 SI, veterans, and people with visible/non‑visible disabilities.We have a dedicated webpage for accommodations where you can learn more about what we offer, and request accommodation: In order to submit candidates for roles, our clients will sometimes require personal information to confirm the identity of applicants and their legal status to work. Raise will never ask you for personal or banking information unless you have been selected for a job. If you are ever unsure about the legitimacy of this or another job posting by Raise (or have any other questions), please contact us at or hello@#J-18808-Ljbffr

📌 Security Architect - Senior (Toronto)
🏢 Ian Martin Group
📍 Toronto