Cyber Security Analyst- SA&A

Summary

We are looking for a Cybersecurity Analyst with expertise in Security Assessment and Authorization (SA&A) to join our Professional Services Delivery this role you will play a key part in assessing security controls ensuring compliance and supporting projects aligned with ITSG33 and Government of Canada security standards. This position requires handson experience conducting security assessments preparing SA&A documentation and working within Government of Canada security frameworks.

A valid Government of Canada PSPC Security Clearance at the SECRET (Level II) level is required.

Key Responsibilities

• Execute Security Assessment & Authorization (SA&A) activities for Government of Canada IT projects.
• Develop and maintain security documentation including High Level Designs (HLDs) Detailed Security Design Documents (CONOPS Access Control Methods) and other security artifacts.
• Ensure compliance with Government of Canada security standards Shared Services Canada (SSC) policies and ITSG33 guidelines.
• Conduct security readiness assessments and guide projects through the process to obtain Authority to Operate (ATO).
• Collaborate with project teams system owners and security stakeholders to identify and mitigate risks.
• Provide expert advice on security controls threat modeling and vulnerability management.
• Work directly with Customer Technical Leads Bell Technical Leads and internal teams to deliver successful technical security solutions aligned with project timelines.
• Provide technical support services to develop integrate and maintain endtoend security solutions.
• Ensure all security documentation aligns with SSC frameworks and government procurement requirements.
• Contribute to the continuous growth of the BBM Public Sector Practice by identifying opportunities and supporting new security solution development.
• Demonstrate strong ownership of outcomes the ability to learn quickly and deliver on time.
• Assist with presales activities including SoW development RFP responses and levelofeffort estimates.
• Participate in technical training on emerging technologies and integrate new capabilities into solutions.
• Build strong relationships across departments and work effectively at all levels of the organization

Critical Qualifications

• 25 years of experience delivering security projects within government or enterprise environments.
• Strong desire to learn adapt and implement new technologies.
• Proven ability to manage multiple projects simultaneously and meet tight timelines.
• Excellent written presentation and communication skills.
• Ability to communicate technical concepts clearly to technical teams end users and management audiences.
• Demonstrated ability to work both collaboratively within a team and independently with minimal supervision.
• Willingness to travel occasionally within Canada based on project needs.
• Ability and willingness to obtain Secret Top Secret or Special Access Security Clearance issued by a Government of Canada agency (or equivalent).

Preferred Qualifications

• Experience working with Security Assessment & Authorization (SA&A) processes and achieving Authority to Operate (ATO) for Government of Canada systems.
• Strong knowledge of ITSG33 Government of Canada security policies and Shared Services Canada (SSC) compliance requirements.
• Familiarity with cloud and onpremises environments including handson experience with security control implementation.
• Proven ability to produce highquality security documentation for largescale IT projects in government or enterprise settings.
• Excellent communication skills with the ability to effectively engage with multiple stakeholders and technical teams.
• Bilingual (English/French) capability is considered a strong asset.
• Experience providing security bestpractice recommendations related to assessment security architecture or solution implementation.
• Degree or Diploma in Computer Science Systems Engineering IT Security or a related field.
• Professional certifications such as CISSP CISM OSCP CISA CCIE or equivalent credentials are considered an asset