[Hiring] Senior IT Security Engineer @NTT DATA Services

Role Description

We are currently seeking a Senior IT Security Engineer to join our team Remote in Canada.

Project Summary:

• Provide expert support to the Cyber and IT Security (CITS) Directorate within the Innovation, Information and Technology Branch (IITB).
• Conduct an independent Cybersecurity Posture Audit of cybersecurity governance, controls, processes, capabilities, and operational practices.
• Assess the ability to identify, protect against, detect, respond to, and recover from cybersecurity threats and risks.
• Focus on stakeholder interviews and evidence gathering.
• Document findings, observations, risk ratings, and recommendations in draft and final audit reports.
• Present audit results to management and executive stakeholders.

Qualifications

• 10+ years of recent experience working as an IT Security Engineer or similar.
• 10+ years of experience with:
  • Conducting cybersecurity audits, cybersecurity posture assessments, or independent security reviews.
  • Assessing cybersecurity governance, risk management, and security control frameworks.
  • Identifying cybersecurity risks, vulnerabilities, control deficiencies, and opportunities for improvement.
  • Evaluating compliance with cybersecurity policies, standards, directives, and regulatory requirements.
  • Developing audit findings, risk assessments, and recommendations for management consideration.
  • Preparing and delivering cybersecurity audit reports, executive briefings, and management presentations.
  • Working within large, complex IM/IT environments.
• Must hold a valid Secret Security Clearance and have experience working with the Federal Government.
• Must have a Canadian university degree or college/CEGEP diploma related to computer science, business administration, information technology, engineering or the equivalent as established by a recognized Canadian academic credentials assessment service.

Requirements

• Experience conducting cybersecurity audits or assessments within the Government of Canada or other public-sector environments.
• Knowledge of Treasury Board Secretariat (TBS) and Canadian Centre for Cyber Security (CCCS) security requirements.

Tasks & Responsibilities

• Information Gathering and Evidence Collection:
  • Conduct stakeholder interviews and evidence-gathering activities to support the Cybersecurity Posture Audit.
• Governance and Risk Management:
  • Assess cybersecurity governance and risk management capabilities, controls, processes, and practices.
• Identity and Privileged Access:
  • Assess Identity and Access Management (IAM) and Privileged Access Management controls and practices.
• Vulnerability Management:
  • Evaluate vulnerability management processes and practices.
• Monitoring and Incident Response:
  • Assess security monitoring, logging, and detection capabilities, along with security incident management and response.
• Infrastructure, Network, and Cloud Security:
  • Assess the security of infrastructure, network, and cloud environments.
• Application Security:
  • Assess application security controls and practices.
• Data Protection and Cryptography:
  • Assess data protection and cryptographic controls.
• Business Continuity and Disaster Recovery:
  • Review business continuity and disaster recovery capabilities and practices.
• Awareness and Training:
  • Assess cybersecurity awareness and training practices.
• Standards and Policy Alignment:
  • Conduct the assessment using applicable Government of Canada cybersecurity policies, standards, directives, and guidance, including ITSG-33, ITSP.10.03X, ITSAP.80.086, and ITSM.10.089.
• Risk and Compliance Identification:
  • Identify risks, vulnerabilities, control deficiencies, and opportunities for improvement, and evaluate compliance with departmental and Government of Canada security requirements.
• Audit Reporting:
  • Document audit findings, observations, risk ratings, and recommendations.
• Draft Report Review:
  • Prepare and submit a Draft Cybersecurity Posture Audit Report for review and comment by the Project Authority and designated stakeholders.
• Final Report:
  • Incorporate approved feedback and comments, and prepare and submit the Final Cybersecurity Posture Audit Report.
• Presentation of Results:
  • Prepare and deliver an Audit Results Presentation summarizing the scope, methodology, findings, risk ratings, recommendations, and overall assessment of ESDC's cybersecurity posture.