Digital Health
Location: 70 O'Leary Avenue

Technical Architect II - Enterprise Security Architect
Digital Health - ARCHITECTURE
Temporary Full-time (Approx. 24 months)

Hours 70 (8 hours; Days)
Salary (HL-22 $76,523 - $99,480) *Subject to Classification Review*
Competition Number VAC0005325
Posted Date 2025-01-06
Closing Date 2025-01-20
Demands, duties, qualifications The Technical Architect II - Enterprise Security Architect role marks a pivotal step in fortifying NLHS's commitment to safeguarding patient data and strengthening our IT infrastructure against evolving cyber threats. This senior position encompasses strategic responsibilities for developing and implementing a comprehensive security framework tailored for the healthcare domain. The architect ensures NLHS maintains robust defenses while adhering to regulatory requirements and aligns security initiatives with organizational goals. This role plays a central part in:
• Shaping the long-term security strategy and policies.
• Leading security architecture design and implementation.
• Providing expert guidance on emerging threats and technologies.
• Collaborating across departments to foster a security-conscious culture.

Strategic Security Planning:
• Develop and sustain long-term security strategies that are aligned with NLHS's business objectives and healthcare mandates.
- Ensure security strategies integrate seamlessly with the overall IT strategy and enterprise architecture, addressing both current and emerging threats.
- Drive the adoption of advanced security models such as Zero Trust Architecture and Cloud Identity frameworks, aligning them with strategic goals and adapting to the evolving threat landscape.

Security Framework Development:
• Lead the design, implementation, and ongoing maintenance of a comprehensive security framework for NLHS's provincial healthcare IT environment, aligning it with strategic goals and regulatory requirements.
- Define, develop and contribute to security policies, standards, and procedures aligned with industry best practices and regulatory requirements.
- Integrate Secure-by-Design principles into security frameworks, ensuring that security considerations are embedded in system architecture from inception to implementation.

Risk Assessment and Mitigation:
• Develop and refine the security risk assessment framework, setting standards and methodologies that align with the organization's strategic goals, regulatory requirements, and evolving threats.
- Define the processes for identifying vulnerabilities, guiding security teams to conduct assessments consistently across systems.
- Incorporate both defensive measures (e.g., incident prevention, resilience) and offensive measures (e.g., threat hunting, red teaming) to create a balanced risk mitigation strategy.

• Lead the strategic response to identified risks, providing high-level architectural recommendations that address vulnerabilities and enhance overall security posture.
- Ensure that mitigation strategies are embedded into security architecture, integrating insights from metrics, threat intelligence, and incident analysis.
- Utilize findings from post-mortem incident reports and ongoing security metrics to inform security strategy, adapting architecture to respond to new and emerging risks.

• Contribute to enterprise risk management (ERM) initiatives, advising on risk prioritization and ensuring security is integrated into the broader ERM processes.
- Provide guidance on the effectiveness and efficiency of security controls, using analysis to recommend architectural improvements and strategic adjustments.
- Develop tests, testing approaches and methodologies to evaluate effectiveness of security controls and holistic security postures for distinct functional solutions.

Security Solution Design and Implementation:
• Architect and integrate security solutions that align with the organization's overall security architecture and strategic goals.
- Design secure solution architectures, system configurations, and integrations that enhance both resilience and adaptability.
- Evaluate, recommend and oversee the implementation and optimization of security tools and technologies, including SIEM systems, intrusion detection/prevention systems, firewalls, encryption protocols, and identity and access management (IAM) solutions to ensure comprehensive coverage of the threat landscape.
Lead the operationalization of security technologies, ensuring they are effectively deployed, managed, and monitored within the environment.
- Establish processes for continuous monitoring and maintenance, enabling both defensive (preventive) and proactive (detective) security measures to function optimally.
- Collaborate with the security team to ensure technologies are integrated into day-to-day operations and effectively support security objectives.

In coordination with DevOps Enterprise Architect, embed security into development pipelines, advancing DevSecOps practices within the organization.
- Implement security measures within DevOps workflows, ensuring secure software development techniques are followed from coding to decommissioning.
- Develop secure coding guidelines, automated security checks, and continuous integration mechanisms that align with Secure-by-Design principles.

Collaboration with Security Analysts:
• Provide strategic guidance to security analysts in defining standards, metrics, and KPIs for effectively monitoring and evaluating security measures.
- Oversee and support the implementation of comprehensive threat monitoring and incident response strategies, ensuring alignment with the overarching security architecture.
- Facilitate a culture of continuous improvement in security operations by leveraging insights from analytics and collaborating on enhancements to threat detection and response capabilities.

Policy Development and Governance:
• Lead the creation and continual refinement of security policies, standards, and guidelines, ensuring they are aligned with industry best practices and evolving requirements.
- Collaborate with cross-functional teams to establish governance frameworks that enforce compliance with internal policies and guidance as well as external regulations.
- Provide strategic oversight to ensure policies are effectively communicated, adopted, and consistently applied across the organization.

Vendor and Third-Party Management:
• Lead the evaluation and selection of security vendors and service providers, ensuring their solutions and services align with organizational needs and strategic security objectives.
- Oversee the integration of third-party solutions, providing strategic guidance to ensure compatibility with the existing security architecture and facilitating collaboration for ongoing technical support.
- Assess and validate third-party solutions for compliance with security requirements, risk management policies, and alignment with organizational goals.
- Collaborate with internal teams and external partners to establish and maintain robust tools and methodologies that mitigate supply chain risks, ensuring a cohesive approach to third-party security management.

Compliance Assurance:
• Ensure organizational adherence to healthcare data regulations such as PIPEDA, PHIA, and industry standards like HIPAA, providing strategic direction for compliance efforts.
- Embed Privacy by Design principles into the security architecture and system development lifecycle, ensuring privacy considerations are proactively integrated.
- Oversee and review the findings from security audits and compliance assessments conducted by the security team, providing high-level analysis and strategic input.
- Assess and prioritize compliance gaps based on testing, metrics, and audit outcomes to recommend strategic measures to address deficiencies, aligning corrective actions with the overall security strategy.

Emerging Threat Analysis and Advanced Technologies:
• Stay informed on the latest cybersecurity trends, emerging threats, and advancements in threat protection technologies, using this knowledge to anticipate potential risks and inform strategic security initiatives.
- Evaluate and recommend the adoption of AI and machine learning technologies for proactive threat detection and response, ensuring these solutions align with and enhance the organization's overall security architecture.
- Continuously assess and advise on the integration of new technologies, tools, and techniques to strengthen the organization's security posture, leading efforts to innovate and adapt to the evolving threat landscape.

Incident Response and Crisis Management:
• Guide and oversee the development and ongoing refinement of incident response plans and procedures in collaboration with the security team, ensuring they align with organizational policies, security architecture, and regulatory requirements.
- Work collaboratively with other IT functional areas to build the needed information to quickly and efficiently assess and address possible security breaches to critical health services and solutions.
- Provide architectural expertise and strategic direction during investigations of significant security incidents, ensuring that responses are efficient and integrated with the overall security infrastructure.
- Offer expert guidance and leadership during security emergencies, coordinating with crisis management teams to minimize impact, expedite recovery, and implement measures to prevent recurrence.

Technology Evaluation and integration:
• Lead the evaluation, selection, and strategic recommendation of security products and services, ensuring they align with the organization's security strategy and long-term goals.
- Oversee the seamless integration of new security technologies into existing systems and architecture, providing guidance to ensure optimal functionality and minimal disruption.
- Collaborate with cross-functional teams to ensure new technologies are effectively incorporated and contribute to the overall enhancement of the organization's security posture.
Metrics and Reporting
• Collaborate with the security team to define and establish meaningful security metrics and key performance indicators (KPIs) that align with strategic objectives and provide a comprehensive view of the effectiveness and efficiency of the security program.
- Offer architectural insights to support the interpretation and analysis of metrics, ensuring data-driven decisions that enhance the security posture.
- Present a holistic view of the organization's security posture with metrics tailored to multiple levels of the organization, including executive leadership.
- Use available metrics to develop and deliver strategic recommendations for continuous improvement and future-proofing the security architecture.
Collaboration and Communication
• Coordinate with provincial IT, privacy, and business units to integrate security practices seamlessly across all operations, projects, and program activities, ensuring alignment with organizational objectives and regulatory standards.
- Provide strategic technical guidance and security expertise to stakeholders at all levels, facilitating informed decision-making and fostering a culture of security awareness.
- Act as a liaison between technical teams and business leadership to ensure that security solutions and architecture support and enhance business objectives, balancing security requirements with operational efficiency and user experience.
- Build and maintain strong relationships with government security personnel and external security vendors, ensuring collaboration and alignment on shared security goals and initiatives.

Your education and experience include:
• Bachelor's Degree in Computer Science, Information Security, or a related field.
• Master's Degree or relevant postgraduate qualification are an asset.
• Minimum of 10 years of experience in information security, with at least 5 years in a security architect or similar senior position.
• Proven experience in the healthcare industry is strongly preferred.
• Extensive knowledge of security frameworks and standards (e.g., ISO 27001/27002, NIST, SOC, CIS, COBIT).
• Hands-on experience with:
- Network Security: Design and implementation of secure network architectures.
- Application and Software Security: Secure Software Development Lifecycle (SSDLC), code reviews, application security testing tools (SAST, DAST).
- Cloud Security: Security services in major cloud platforms (AWS, Azure, Google Cloud).
- Endpoint Protection: Advanced threat protection technologies and techniques.
- DevSecOps Practices: Integration of security into DevOps pipelines.
• Deep understanding of Canadian privacy laws and healthcare regulations, including PIPEDA, PHIA, as well as international regulations such as HIPAA.
• Experience with Privacy by Design and security principles.
• Experience with compliance audits and regulatory reporting.

It would be considered an asset if you have the following:
• Professional certifications such as CISSP, CISM, CCSP, SABSA, TOGAF, AWS Certified Security Specialty are highly desirable.
• Familiarity with security tools and technologies such as:
- SIEM Systems: IBM QRadar, Splunk, Microsoft Sentinel
- IDS/IPS: Snort, Suricata
- Firewalls and VPNs: Cisco, Palo Alto Networks, Fortinet
- Encryption Technologies: SSL/TLS, PKI, AES
- IAM Tools: Microsoft Active Directory / Entra, ForgeRock
- Vulnerability Management Systems: Nessus, Qualys
- Endpoint Security: CrowdStrike Falcon, Microsoft Defender
- Cloud Protection: CrowdStrike Cloud Protection, Microsoft Defender for Cloud

Demonstrated equivalencies may be considered.