Business Analyst Cybersecurity

Context and Mandate

The Data Protection (PDD) capability encompasses four complementary pillars: cryptography (PKI, certificate lifecycle management, and cryptographic platform resilience), data loss prevention (DLP), post-quantum cryptography (PQC), and artificial intelligence security (CYBAI).

As the capability begins its FY2027 planning cycle, it must develop its 2027-2029 roadmap across these four pillars. We are seeking a Cybersecurity Business Analyst to support roadmap development, the 2026 control maturity assessment, and intake deliverables for the 2027 demand management and budget assessment process. The immediate focus will be on cryptography and PQC, with support for the DLP and CYBAI pillars as priorities evolve.

The successful candidate will work closely with Product Owners (POs), security segments, technical teams, and partner business units.

Responsibilities

• Develop the 2027-2029 PDD roadmap across all four pillars: cryptography (PKI and certificate lifecycle management at scale, and cryptographic platform resilience), data loss prevention (DLP), post-quantum cryptography and cryptographic agility, and AI security (CYBAI).
• Business requirements analysis: Gather and formalize business needs and functional requirements related to the post-quantum transition and cryptographic agility; ensure alignment between standards and controls.
• Impact analysis: Document business processes and use cases affected by cryptographic changes in collaboration with technical teams.
• Risk management and prioritization support: Collect and organize the information required to assess quantum risks and prioritize migration initiatives.
• Transformation initiative coordination: Document migration scenarios, track requirements, and facilitate collaboration between business and security teams.
• Support for the DLP and CYBAI pillars: Help define requirements and document processes related to data loss prevention and AI security, based on capability priorities.
• Support the 2026 control maturity assessment across all four PDD pillars.
• Prepare intake deliverables for the 2027 demand management and budget assessment process.
• Coordinate stakeholders, including Product Owners, security segments, and partner business units.

Requirements

• Proven business analysis experience, including requirements elicitation and documentation, process documentation, and use case development.
• Cybersecurity knowledge: General understanding of security risks, data protection, and compliance considerations.
• Ability to support technology transformations: Experience with IT modernization projects, ideally in cybersecurity, and the ability to collaborate with multidisciplinary teams.
• Ability to coordinate multiple stakeholders and produce structured deliverables within tight timelines.
• Proficiency in using generative AI tools, such as GitHub Copilot and writing assistants, to accelerate documentation, synthesis, and requirements structuring.

Assets

• Experience in security or data protection.
• Exposure to cryptography, PKI, or certificate lifecycle management; in-depth cryptography expertise is not required.
• Exposure to data loss prevention (DLP) or artificial intelligence security.
• Familiarity with applicable regulatory frameworks and requirements, including OSFI B-13, E-21, E-23, and Québec's Law 25.
• Experience with the Scaled Agile Framework (SAFe), Jira, and Confluence.