Senior Security Engineer

Job Title: Senior IT Security Engineer

Duration: 03/31/2027 + extensions

Location: Canada - Remote

Note: Candidates must hold an active Secret Security Clearance and have previous Federal Government experience.

Project Overview

We are seeking an experienced Senior IT Security Engineer to support an independent Cybersecurity Posture Audit within a large federal government IT environment.

The role will focus on evaluating cybersecurity governance, risk management, security controls, processes, and operational capabilities. The successful candidate will conduct stakeholder interviews, gather evidence, assess security practices against Government of Canada standards, identify risks and control gaps, and prepare audit reports and executive presentations.

Mandatory Qualifications

• 10+ years of recent experience as an IT Security Engineer or in a similar role.
• 10+ years of experience in:
• Conducting cybersecurity audits, posture assessments, and independent security reviews.
• Assessing cybersecurity governance, risk management, and security control frameworks.
• Identifying security risks, vulnerabilities, control gaps, and improvement opportunities.
• Evaluating compliance with security policies, standards, directives, and regulatory requirements.
• Developing audit findings, risk assessments, and recommendations.
• Preparing audit reports, executive briefings, and management presentations.
• Working in large and complex IM/IT environments.
• Valid Secret Security Clearance.
• Previous experience working with the Federal Government.
• Canadian university degree or college/CEGEP diploma in Computer Science, Business Administration, Information Technology, Engineering, or an equivalent recognized credential.

Key Responsibilities

• Conduct stakeholder interviews and cybersecurity evidence-gathering activities.
• Assess cybersecurity governance, risk management, and security controls.
• Evaluate Identity and Access Management (IAM) and Privileged Access Management (PAM).
• Review vulnerability management, security monitoring, logging, and incident response.
• Assess infrastructure, network, cloud, and application security.
• Evaluate data protection and cryptographic controls.
• Review business continuity and disaster recovery capabilities.
• Assess cybersecurity awareness and training practices.
• Evaluate compliance with applicable Government of Canada security policies, standards, and directives, including ITSG-33, ITSP.10.03X, ITSAP.80.086, and ITSM.10.089.
• Identify security risks, vulnerabilities, control deficiencies, and opportunities for improvement.
• Document audit findings, observations, risk ratings, and recommendations.
• Prepare draft and final Cybersecurity Posture Audit Reports.
• Present audit findings, recommendations, and overall cybersecurity posture to management and executive stakeholders.