Architect (SecOps)

The Senior Technology Architect role requires deep knowledge expertise and experience in in cyber security solutions security operations (SecOps) solutions and practices automation and artificial intelligence (AI) in cyber security managed security services and next-generation network security. The resource also requires hands-on experience in analyzing configuring implementing and troubleshooting cyber security models automation solutions and threat detection particularly within the education sector preferably in the Ontario K12 school board environment.

This resource is responsible for but not limited to:

• Leading operational cyber defense guidance incident coordination monitoring maturity and integration with MSS/MDR providers including:
  

  • Threat monitoring detection and analysis across network endpoint identity and cloud environments
    
  • Incident response coordination escalation management and root cause analysis
    
  • Security operations centre (SOC) coordination and operational alignment
    
  • Establishing and enhancing cyber operational readiness (playbooks processes response validation)
    
  • MSS onboarding integration and service adoption across boards
    

• Delivering solution guidance technical training and implementation support for next-generation network and security technologies including:
  

  • Security Service Edge (SSE) / Secure Access Service Edge (SASE) including integration of network and security functions such as Secure Web Gateway (SWG) Cloud Access Security Broker (CASB) Zero Trust Network Architecture (ZTNA) and Firewall-as-a-Service (FWaaS)
    
  • SD-WAN (Software-Defined Wide Area Network) and SDN (Software-Defined Networking)
    
  • Identity and access management (passwordless password-based certificate-based and multi-factor authentication (MFA))
    
  • Endpoint security (Endpoint Protection Platforms (EPP) Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR))
    
  • Advanced threat protection (Intrusion Prevention Systems (IPS) Intrusion Detection Systems (IDS) Network Access Control (NAC) and Distributed Denial-of-Service (DDoS) protection)
    
  • AI/ML-enabled monitoring analytics and automation
    
  • Incident Response (IR) and Incident Management (IM)
    
  • Vulnerability management and patching automation
    
  • Penetration testing and automated red teaming
    
  • Operational Technology (OT) security
    

• Providing technical guidance solution delivery training and implementation support for hybrid cyber security operating models integrating internal teams and Managed Security Service Providers (MSSPs) including:
  

  • MSS strategy onboarding optimization and performance management
    
  • Alignment and integration of Security Information and Event Management (SIEM) Security Orchestration Automation and Response (SOAR) EDR/XDR and threat intelligence platforms
    
  • School board MSS readiness transition planning and governance models
    
  • Security operations architecture threat detection incident response and automation workflows
    
  • Governance risk and compliance in hybrid (in-house and outsourced) environments
    
• Providing subject matter expertise in Network Operations Centre (NOC) and Security Operations Centre (SOC) technologies and tools including SIEM SOAR and network monitoring and management platforms
  

• Managing and optimizing SecOps platforms (SIEM SOAR EDR/XDR CASB IDR vulnerability management ) including:
  

  • Telemetry ingestion log normalization and real-time correlation
    
  • Development and maintenance of detection use cases
    
  • Integration of threat intelligence into detection workflows
    
  • Maintenance of security content (rules dashboards playbooks)
    
• Leading incident investigation and response activities including deep-dive analysis root cause determination and facilitation of cyber exercises to validate readiness
  
• Conducting baseline reviews vulnerability triage and collaborating with MSSPs to track and validate remediation efforts
  
• MUST HAVE
  

NICE TO HAVE

Network and Network Security 25%

• 5 years of experience with network infrastructure (LAN/WAN VPN VLAN) and network hardware (switches routers firewalls)
  
• 5 years of experience with software-defined networking technologies (SDN/SD-WAN) (e.g. Fortinet Meraki Palo Alto Aruba)
  
• 3 years of experience supporting Ontario K12 school board network environments (WAN LAN Wi-Fi internet delivery)
  
• 2 years of experience with network monitoring and management tools (e.g. SolarWinds FortiManager Panorama)
  
• 2 years of experience with traffic analysis and diagnostic tools (e.g. PRTG Wireshark)
  
• 2 years of experience working with network telemetry and logging formats (e.g. Syslog IPFix NetFlow)
  
• 2 years of experience configuring and troubleshooting network protocols (e.g. MPLS VPLS VLAN Trunking Protocol)
  
• Experience conducting network performance analysis load testing and risk assessments
  
• Experience evaluating emerging network technologies through pilots and proof-of-concepts
  
• Experience integrating networking and security architectures (e.g. SASE ZTNA NDR)
  

Cyber Security Expertise 25%

• 10 years of experience in cyber security and next-generation network security
  
• 5 years of experience implementing enterprise security architectures and automation workflows preferably within Ontario K12 environments
  

• Proven experience with:
  

  • SSE/SASE architectures (SWG CASB FWaaS ZTNA)
    
  • Endpoint security (EPP EDR XDR)
    
  • Advanced threat protection (IPS IDS NAC DDoS protection)
    
  • Identity and access management (passwordless MFA certificate-based authentication)
    
  • Incident Response and Incident Management (IR/IM) platforms
    
  • Automated vulnerability management and patching solutions
    
  • UEBA and threat behaviour analytics
    
  • Penetration testing and automated red teaming tools
    
  • Operational Technology (OT) security and IT/OT convergence
    
  • AI/ML-enabled security monitoring analytics and automation
    
• Strong understanding of layered security models and frameworks (e.g. NIST CSF v2 CIS Controls v8)
  
• Familiarity with MITRE ATT&CK D3FEND and ATLAS frameworks
  
• Experience evaluating emerging cybersecurity technologies through pilots and proof-of-concepts
  

Security Operations and Threat Detection 25%

• Extensive experience managing and optimizing SecOps platforms including SIEM SOAR EDR/XDR CASB IDR and vulnerability management tools
  
• Strong experience in detection engineering including development tuning and lifecycle management of threat detection use cases across identity endpoint email network and cloud environments
  
• Proven experience in incident response including deep-dive investigations root cause analysis and escalation management
  
• Experience supporting MSSP onboarding transition planning and operational readiness in multi-organization environments
  

• Experience designing and implementing hybrid security operations models including:
  

  • MSSP integration optimization and performance management
    
  • Governance risk and compliance in hybrid environments
    
  • Automation and orchestration of security workflows
    
• Expertise in telemetry ingestion log normalization and real-time correlation of security events
  
• Familiarity with SOC/NOC tools including network traffic analyzers performance monitoring and configuration management solutions
  

Training Collaboration & Stakeholder Engagement 10%

• 5 years of experience presenting to senior and executive management and external stakeholders
  
• 5 years of experience coordinating and leading complex multi-stakeholder technical initiatives
  
• 5 years of experience preparing technical documentation and communications (e.g. reports briefings recommendations)
  
• 5 years of experience delivering cybersecurity training and upskilling programs to IT and security teams
  
• Experience supporting cross-organizational collaboration and knowledge sharing (e.g. threat intelligence sharing)
  

Industry Certifications / Relevant Degrees 10%

• Bachelors degree in computer science cyber security or a related field.
  
• Postgraduate degree (e.g. . and/or Ph.D.) in computer science cyber security or engineering is preferred.
  
• Relevant vendor certifications or equivalent work experience.
  

• Industry-recognized security certifications preferred including:
  

  • Certified Information Systems Security Professional (CISSP)
    
  • Certified Information Security Manager (CISM)
    
  • Certified Cloud Security Professional (CCSP)
    
  • Other examples include Certified Ethical Hacker (CEH) Certified Information Systems Auditor (CISA) Certified in Risk and Information Systems Control (CRISC).
    

Public Sector Experience 5%

• Knowledge of Government of Ontario standards (e.g. GO-ITS) and applicable legislation (e.g. Enhancing Digital Security and Trust Act 2024(EDSTA))
  
• 5 years of experience working in the Ontario public sector with at least 3 years supporting K12 school board network and cybersecurity environments
  

Supplier Comments

Closing Date/Time: :00 p.m. EST

Max submission: 3 (three)

Hybrid - 2 days onsite / 3 days remote

Required Skills:

Mandatory Skills & Experience Cloud & Infrastructure Engineering Proven experience designing deploying and maintaining hybrid infrastructure environments across: Microsoft Azure Amazon Web Services (AWS) Linux-based environments SaaS solutions COTS solutions On-premises systems Strong experience with Windows and Linux server administration including: CentOS Ubuntu CoreOS Experience supporting modern web technology stacks including: LAMP MEAN Drupal Elasticsearch Experience with virtualization platforms storage solutions networking and enterprise infrastructure services. Strong understanding of cloud architecture frameworks technology assessments and cloud solution strategies. Identity & Access Management Experience managing and supporting identity and access controls using: Active Directory Microsoft Entra ID Enterprise IAM solutions Experience implementing authentication authorization and access governance controls. DevOps & CI/CD Automation Strong experience designing building and administering CI/CD pipelines for continuous integration and deployment. Experience with development and collaboration tools including: Azure DevOps JIRA Confluence Maven Jenkins Experience with Infrastructure as Code (IaC) and version-controlled deployments. Strong knowledge of DevOps methodologies automation frameworks and release management best practices. Experience with containerization and orchestration technologies including: Docker Kubernetes AKS / EKS Experience automating operational and compliance-related activities using: PowerShell Bash Python Programming & Scripting Hands-on experience with scripting and programming languages including: Python Bash PHP Java JavaScript Experience with build and configuration management tools including: Git Ansible Chef Puppet API & Integration Experience Experience building and consuming APIs and integration endpoints. Experience integrating cloud platforms enterprise systems and deployment pipelines. Understanding of enterprise integration architectures and service-based deployments. Security Monitoring & Compliance Strong understanding of infrastructure security cloud security and DevOps security best practices including: Least privilege access Secure logging Secrets management Vulnerability remediation Experience with security and monitoring tools including: Radware Dynatrace Splunk Azure Monitor / Log Analytics AWS CloudTrail / CloudWatch ELK Stack / SIEM solutions Experience implementing centralized audit logging and monitoring across enterprise platforms. Ability to support internal and external audits through reporting evidence gathering and log analysis. Experience supporting forensic investigations audit remediation and incident reviews. Familiarity with Government of Ontario I&IT Directives Policies and Information Technology Standards. Release Management & Operational Support Experience coordinating infrastructure and application releases across technical and business teams. Knowledge of change management processes deployment approvals rollback planning and release governance. Experience with release readiness reviews deployment validation and post-release monitoring. Ability to maintain release documentation operational records and audit artifacts. Project Management & Communication Strong project planning coordination and resource management skills. Experience with roadmap planning modernization initiatives and infrastructure investment planning. Strong stakeholder communication and cross-functional collaboration skills. Ability to explain complex technical concepts to business users leadership teams and non-technical stakeholders. Strong documentation reporting presentation and technical writing skills. Mobile Device Management Experience supporting mobile device management for cellular devices and tablets across multiple platforms and operating systems. Desirable Skills Experience supporting Government of Ontario enterprise environments. Experience with enterprise modernization and cloud transformation initiatives. Familiarity with enterprise governance compliance frameworks and audit readiness programs. Experience mentoring and coaching junior DevOps and infrastructure resources. Strong understanding of operational resilience disaster recovery and enterprise monitoring strategies. Additional Information Strong hands-on DevOps cloud infrastructure automation CI/CD security and enterprise release management experience is mandatory for this role.