Client: Supply Ontario – RQ00824
We are seeking a
Senior Security Architect with extensive experience in Cyber Security Incident Response (CSIRT/SOC), incident coordination, security program maturity, and hands-on Zero Trust implementation. The ideal candidate will have strong expertise in Identity and Access Management (IAM), network security, incident response governance, stakeholder communications, and operationalizing security controls. The successful candidate will support the Director, Cyber Security Defence & Resilience, in strengthening cyber security resilience across the Agency and the broader health sector, improving incident response processes, and implementing practical Zero Trust solutions aligned with the Agency’s AI-Driven Risk Mitigation Program.
Role Snapshot
- Job Title: RQ00824 – Security Architect – Senior
- Client: Supply Ontario
- Work Location: 525 University Avenue, Toronto, Ontario, Canada
- Work Arrangement: Hybrid – Up to 3 days onsite, subject to the Hiring Manager’s discretion
- Estimated Start Date: November 30, 2026
- Estimated End Date: August 10, 2027
- Business Days: 175.00
- Extension: Option to extend for up to an additional 250 days at the Agency’s discretion, subject to the applicable terms
- Hours: 7.25 hours per day, 5 days per week
- Public Sector Experience: Nice to Have
Must Have
- Cyber Security Incident Response (CSIRT) Experience
- Demonstrated experience coordinating and managing cyber incidents, not just participating in them.
- Experience working in CSIRT/SOC environments.
- Involvement in the incident lifecycle, including triage, coordination, recovery, and post-incident reviews.
- Experience supporting cross-functional and external stakeholder engagement during incidents.
- Cyber Security Incident Response – Communication, Reporting & Program Maturity
- Proven ability to communicate effectively during incident situations, including with external stakeholders.
- Strong experience developing incident reports, executive briefings, and communications.
- Experience building or improving procedures, playbooks, policies, and standards.
- Demonstrated contribution to program maturity, governance, and process improvement, including awareness of AI-driven threats and experience aligning incident response and Zero Trust work with broader program workstreams.
- Zero Trust Implementation (Hands-On Delivery)
- Proven hands-on experience implementing Zero Trust technologies, especially in Identity and Access Management (IAM).
- Ability to identify gaps in identity, access, and security architecture.
- Experience translating Zero Trust concepts into operational controls and outcomes.
- Demonstrated involvement in implementation, not just strategy or design.
- Identity & Network Security Expertise (Zero Trust Enablers)
- Strong experience with identity security controls, including MFA, Conditional Access, RBAC, PAM/PIM, and Entra ID.
- Working knowledge of network security aligned with Zero Trust, including segmentation, secure access models, and Zero Trust Network Access (ZTNA).
- Experience integrating identity and network controls into operational environments.
Description
Background Information
The purpose of this request is to onboard a contingent cyber security resource to support the Director, Cyber Security Defence & Resilience, with both operational and strategic initiatives across the Agency and the broader health sector.
This Role Will Focus On Two Primary Areas
Cyber Security Incident Response (CSIR)
Enhancing program maturity, strengthening governance, and supporting the coordination of day-to-day cyber security incidents across the Agency and the health sector. A strong emphasis will be placed on communication, stakeholder engagement, including external audiences, and high-quality reporting, along with the development of procedures, policies, and standards.
Zero Trust Implementation
Supporting the hands-on implementation and operationalization of Zero Trust principles and technologies across the enterprise. This includes assessing current security architecture, identifying gaps in identity, access, and network security controls, and working closely with Cyber Security Defence (CSD), Information Security Office (ISO), and operational teams to implement practical, integrated solutions.
This role is not deeply technical in areas such as digital forensics, but requires a strong background and hands-on experience in CSIRT/Security Operations and Zero Trust implementation to ensure delivery of real, measurable outcomes and an operational Zero Trust model.
This engagement sits within the Agency’s broader AI-Driven Risk Program and mitigation plan, established in response to the rapid rise of adversarial AI capabilities that are increasing the volume, speed, and complexity of cyber-attacks across the health sector.
The plan is being executed through several workstreams spanning “Prevent & Reduce Exposure,” “Detect, Contain & Respond,” and “Outpace the Adversary.” While this role is focused primarily on Cyber Security Incident Response and Zero Trust implementation, the resource is expected to align their work with and support the relevant workstreams, recognizing that Zero Trust and incident response are central enablers of the organization’s ability to defend at machine speed.
Responsibilities
- CSIRT (Cyber Security Incident Response Team)
Lead Program Maturity Initiatives
- Develop and maintain incident response procedures, playbooks, policies, and standards.
- Establish and improve incident response governance, processes, and workflows.
- Define KPIs, metrics, and reporting for program effectiveness.
- Support tabletop exercises and simulation activities.
Collaborate with Stakeholders Across the Agency and Health Sector
- Support coordinated incident response and communication.
- Provide advisory support during sector-wide cyber incidents.
- Promote cyber resilience and standardized security practices.
- Support incident response readiness for AI-accelerated and machine-speed threats, including faster containment and “breach vs. break” decision playbooks.
Support and Enhance the Cyber Security Incident Response Program
- Coordinate cyber incident response activities across internal teams and external stakeholders.
- Act as a key point of contact for incident communications, including engagement with external partners and sector organizations.
- Develop incident reports, executive briefings, and communication materials.
- Support non-forensic incident response activities, leveraging CSIRT/SOC experience.
- Zero Trust
Drive Practical Integration Across Domains
- Translate Zero Trust principles into enforceable controls, processes, and standards.
- Support alignment across identity, endpoint, and network security components.
- Bridge strategy, architecture, and day-to-day operations.
- Align Zero Trust and identity work with the program’s workstreams, particularly:
- Legacy modernization and Zero Trust controls.
- Securing external doors through MFA and Conditional Access.
- Accelerated vulnerability remediation.
- Contribute to these efforts at a supporting level.
Support and Deliver Zero Trust Implementation
- Assess current-state architecture and identify gaps in identity, access, and network security controls.
- Support or lead hands-on implementation of Zero Trust-aligned technologies, particularly in identity.
- Work closely with technical teams to configure, integrate, and operationalize security solutions.
- Ensure Zero Trust capabilities are embedded into operational practices, not just deployed.
Desired Skills
- Experience in healthcare or public sector environments, particularly the Ontario health sector.
- Familiarity with regulatory and security frameworks, such as PHIPA, NIST CSF, and ISO 27001.
- Experience supporting cross-organizational incident response coordination.
- Experience implementing Conditional Access, PAM/PIM (Privileged Access Management/Privileged Identity Management), or identity governance solutions.
- Exposure to Zero Trust maturity models or assessments.
- Knowledge of cloud security environments.
- Experience with network micro-segmentation or Zero Trust Network Access (ZTNA).
- Experience with SOAR (Security Orchestration, Automation and Response) platforms or automation of incident workflows.
- Relevant certifications, such as CISSP, CISM, GIAC, or Azure Security Engineer.
- Familiarity with defending against AI-driven and adversarial-AI threats and machine-speed attack techniques.
- Exposure to program-delivery models where security work is organized into coordinated workstreams, such as attack-surface reduction, Continuous Threat Exposure Management (CTEM), and AI-enabled detection.
Required Skills
- Minimum 7–10 years of experience in cyber security, with strong exposure to Incident Response and Security Operations (CSIRT/SOC).
- Proven experience coordinating and managing cyber incidents, including communication with internal and external stakeholders.
- Strong ability to produce clear, concise reports, executive briefings, and incident communications.
- Experience developing incident response procedures, policies, standards, and playbooks.
- Proven hands-on experience implementing Zero Trust technologies, particularly in Identity and Access Management (IAM).
- Demonstrated ability to assess security environments and identify gaps, especially across identity and network security domains.
- Strong experience with identity-focused controls, such as MFA, Conditional Access, identity governance, and privileged access.
- Practical experience translating Zero Trust concepts into operational controls and measurable outcomes.
- Experience working with the Microsoft security ecosystem, such as Defender, Sentinel, and Entra ID, and the AWS security ecosystem, such as GuardDuty and Security Hub.
- Solid understanding of network security concepts aligned with Zero Trust, such as segmentation and secure access models.
- Excellent written and verbal communication skills, including executive-level engagement.
- Working awareness of the modern AI-driven threat landscape, including AI-accelerated exploitation and automated or machine-speed attacks, and their implications for incident response and Zero Trust priorities.
Strong Expertise in
- Cyber Security Incident Response coordination and program maturity.
- Security Operations and CSIRT environments.
- Zero Trust implementation, not just strategy.
- Identity and Access Management (IAM) as a core Zero Trust pillar.
- Network security principles supporting Zero Trust architectures.
Demonstrated Ability to
- Assess environments and identify control gaps, particularly in identity and access.
- Implement and operationalize security technologies, ensuring adoption into daily operations.
- Translate Zero Trust concepts into practical, measurable solutions.
- Develop policies, procedures, playbooks, and standards.
- Produce high-quality reporting and executive communications.
Solid Understanding of
- Incident response lifecycle aligned with NIST (National Institute of Standards and Technology) or industry standards.
- The modern cyber threat landscape and attack vectors.
Core Competencies
- Strong communication and stakeholder management skills, both internal and external.
- Ability to operate in high-pressure incident environments.
- Analytical thinking and structured problem-solving.
- Ability to bridge technical teams and leadership audiences.
- Strong focus on execution, delivery, and measurable outcomes.
Additional Deliverables
Deliverables are not limited to the above and may evolve based on:
- Organizational priorities.
- Emerging threats or incident activity.
- Maturity needs across CSIRT and Zero Trust initiatives.
The resource is expected to adapt to changing requirements and contribute broadly to:
- Cyber security program maturity.
- Operational effectiveness and resilience.
Alignment to the AI-Driven Risk Mitigation Program
- Ensure CSIRT and Zero Trust deliverables are consistent with, and reference, the relevant workstreams within the workstream program.
- Where applicable, provide input into workstreams tied to identity, access, and Zero Trust controls, such as securing external doors and legacy/Zero Trust modernization, and to incident-response acceleration for AI-era threats.
- Contribute to reporting that connects incident response and Zero Trust progress to the program’s overall risk-reduction objectives.
Deliverables
- Cyber Security Incident Response (CSIRT) Program
Mature the CSIRT Program
- Review, update, and enhance Incident Response (IR) standards, policies, procedures, and playbooks.
- Document and standardize end-to-end incident response workflows across internal teams.
- Work with internal stakeholders and external partners to align workflows, clarify roles and responsibilities, and improve coordination.
- Ensure alignment with industry standards, such as NIST, and organizational requirements.
Support CSIRT Operations
Act As a Lead Responder/coordinator For
- Confirmed internal security incidents.
- Large-scale or high-impact external cyber security incidents affecting the sector.
Additional Responsibilities Include
- Lead incident coordination, stakeholder communication, and reporting activities.
- Produce incident reports, executive briefings, and communication artifacts.
- Conduct and document post-incident reviews and lessons learned, and track improvement actions.
Enhance Communication & Reporting
- Establish or refine incident communication protocols, including external stakeholder engagement.
- Develop standardized reporting templates and communication materials, such as situation reports (SITREPs) and executive summaries.
- Zero Trust Implementation
Current-State Assessment & Gap Analysis
- Work with internal teams to assess the current security posture, with a focus on:
- Identity and access management controls.
- Network security posture, including segmentation and access models.
- Identify and document gaps against the defined Zero Trust framework and architecture.
Tactical Implementation Planning
- Develop a practical, prioritized implementation plan to address identified gaps.
- Focus on key Zero Trust pillars, particularly:
- Identity, including MFA, Conditional Access, and privileged access.
- Network security, including segmentation and secure access models.
Hands-On Implementation & Operationalization
- Support and/or lead implementation of Zero Trust-aligned technologies.
- Work directly with technical teams to configure, integrate, and operationalize solutions.
- Ensure controls are embedded into day-to-day operations and deliver measurable outcomes.
Standards & Integration
- Develop and refine Zero Trust standards, implementation patterns, and guidance.
- Ensure alignment and integration across identity, endpoint, and network security domains.
Additional Terms and Conditions
- The term of this Engagement Assignment is for 175 Business Days, with an option to extend for up to an additional 250 days at the Agency’s discretion. The Engagement Assignment may be extended for unused Business Days at the Agency’s discretion.
- The resource will comply with the Agency’s policies and procedures.
- The resource will be issued an Agency laptop and is expected to provide at least one additional monitor, an external keyboard, and a mouse at their own expense.
- When working from their home location, the resource must have a private office space and is not permitted to work in an open communal space.
- The internet connection must be hard-wired and have suitable bandwidth to support the IT requirements of this role.
- If these conditions cannot be met within the resource’s home office space, the resource will transition to full-time in-office work, and the hybrid option will no longer be available.
- Agency systems cannot be accessed from outside the province of Ontario, and Agency assets, including laptops and related equipment, cannot be removed from the province of Ontario without prior written approval from the Agency.
- Assignment Type: This position is currently listed as Hybrid. The resource under this request will be required to work onsite at the Hiring Manager’s sole discretion.
- Location: Up to 3 days onsite, subject to the Hiring Manager’s discretion.
- Public Sector Experience: Nice to Have.
How to Apply
If you are interested and your profile matches the requirements, kindly send the following mandatory documents to
hrsmss@smsoftconsulting.com by
Monday, October 26, 2026, at 11:30 AM EST.
Mandatory Documents
- Updated Resume in Word format.
- Skills Matrix and References.
- Expected Hourly Rate.
- Visa Status.
- LinkedIn ID.
Without the mandatory documents, we cannot submit a candidate.
Apply Online: Please visit our SMSS career website to apply for this opportunity.
WhatsApp Group
For daily job updates, you can also join our WhatsApp group using the link below:
Join our WhatsApp Group
Email is the best way to reach us.
