Cyber Security Incident Response Manager

Job Summary:

The Senior Security Architect will lead and enhance the Cyber Security Incident Response Team (CSIRT) program and drive the practical implementation of Zero Trust security frameworks. This role involves coordinating incident response activities, developing policies and playbooks, and integrating identity and network security controls to strengthen organizational cyber resilience, particularly in fast-evolving threat environments including AI-driven attacks.

Responsibilities:

• Lead CSIRT program maturity initiatives including incident response procedures, governance, and metrics.
• Coordinate cyber incident response across internal teams and external stakeholders, acting as a key communication point.
• Develop and maintain incident reports, executive briefings, and communication materials.
• Support and lead tabletop exercises and simulation activities to improve incident readiness.
• Translate Zero Trust principles into enforceable controls, processes, and standards across identity, endpoint, and network security.
• Assess current security architecture, identify gaps, and support hands-on implementation of Zero Trust technologies, especially in identity and access management.
• Ensure Zero Trust capabilities are operationalized and integrated into daily security practices.
• Collaborate with stakeholders to promote cyber resilience and standardized security practices within the health sector and broader agency environment.

Required Skills:

• 7 10 years of cybersecurity experience with strong expertise in Incident Response and Security Operations (CSIRT/SOC).
• Proven experience managing cyber incidents and coordinating communication with internal and external stakeholders.
• Strong ability to develop incident response procedures, playbooks, policies, and standards.
• Hands-on experience implementing Zero Trust technologies, particularly in identity and access management (IAM).
• Expertise in identity security controls including MFA, Conditional Access, RBAC, PAM/PIM, and Entra ID.
• Knowledge of network security concepts aligned with Zero Trust such as segmentation and secure access models.
• Experience working with Microsoft and AWS security ecosystems.
• Excellent written and verbal communication skills, including executive-level engagement.
• Working knowledge of AI-driven threat landscapes and implications for incident response and Zero Trust.

Desired Skills:

• Experience in healthcare or public sector environments, particularly within the Ontario health sector.
• Familiarity with regulatory and security frameworks such as PHIPA, NIST CSF, and ISO 27001.
• Experience with Conditional Access, PAM/PIM, identity governance solutions, and Zero Trust maturity models.
• Knowledge of cloud security environments and network micro-segmentation or Zero Trust Network Access (ZTNA).
• Experience with SOAR platforms or automation of incident workflows.
• Relevant certifications such as CISSP, CISM, GIAC, or Azure Security Engineer.
• Exposure to program-delivery models organizing security work into coordinated workstreams.
• Familiarity defending against AI-driven and machine-speed attack techniques.

Rated Criteria:

• Cyber Security Incident Response Coordination and Management - 30 Points
• Zero Trust Implementation and Hands-On Delivery - 25 Points
• Identity and Network Security Expertise - 20 Points
• Incident Communication, Reporting, and Program Maturity - 15 Points
• Knowledge of AI-Driven Threat Landscape and Emerging Security Practices - 10 Points

Total: 100 Points Deliverables:

• Mature CSIRT program through enhanced incident response standards, policies, procedures, and playbooks.
• Lead coordination and communication during confirmed security incidents and sector-wide cyber events.
• Produce incident reports, executive briefings, and post-incident reviews with actionable improvement plans.
• Establish and refine incident communication protocols and standardized reporting templates.
• Conduct current-state security assessments and gap analyses focused on Zero Trust identity and network controls.
• Develop prioritized implementation plans and lead hands-on deployment of Zero Trust technologies.
• Integrate and operationalize security controls into daily operations ensuring measurable outcomes.
• Align CSIRT and Zero Trust initiatives with broader AI-Driven Risk Mitigation Programs and organizational priorities.

Must Haves:

• Proven experience coordinating and managing cyber incidents within CSIRT/SOC environments.
• Strong communication skills with ability to produce clear incident reports and executive communications.
• Hands-on experience implementing Zero Trust technologies, especially identity and access management.
• Deep expertise in identity and network security controls supporting Zero Trust frameworks.
• Ability to translate security concepts into practical, operational controls and measurable outcomes.

Public Sector Experience:

Preferred