Senior Cybersecurity Advisor

About the Role

This is an advisory seat inside the Enterprise Security Architecture function of a major Canadian energy infrastructure organization. The team is small, collaborative, and relatively new, and it exists to review security and architecture designs produced by project and program teams across the enterprise, confirm those designs align with established internal security standards, and work with the owning teams to close any gaps that surface. The work is governance and due diligence applied continuously across a portfolio of in-flight initiatives, not ownership of a single named deliverable. Identity and access management and Zero Trust architecture carry the most weight in the current mandate.

The ideal candidate is a senior cybersecurity professional with ten or more years of experience oriented toward advisory, architecture, or governance work rather than hands-on security operations or tool administration. They have owned or co-owned real identity and access management programs, translated Zero Trust principles into actual design patterns a team adopted, and communicated findings comfortably in both a technical register with peer architects and an executive register with senior stakeholders. They engage a team continuously rather than surfacing only at set intervals, and they are eligible to work in Canada without employer sponsorship.

Key Responsibilities

1. Review security and architecture designs produced by project and program teams across the enterprise, assessing each against the organization's internal Control Barrier Architecture and Enterprise Security Standards
2. Document design gaps and work directly with the owning project team to reach a resolution, whether an alternate solution or an approved, documented exception, rather than issuing top-down directives
3. Apply Zero Trust principles across identity, device posture, network segmentation, and application access, translating them into concrete design guidance a project team can act on
4. Bring an enterprise identity and access management lens into every design review, as IAM carries the greatest weight in this advisory mandate
5. Partner day to day with the Enterprise Security Architecture team, the Information Services team, and other business units, maintaining continuous engagement rather than communicating only at fixed checkpoints
6. Support a standing backlog of in-flight projects and programs that need alignment with enterprise security standards, and contribute early planning input for the following year's security roadmap
7. Communicate findings, risk, and design feedback in two distinct registers: a technical register for peer architects and project teams, and an executive register for senior stakeholders, adjusting framing without losing substance
8. Draw on broader cybersecurity domain knowledge (vulnerability management, SIEM, endpoint security, threat intelligence, governance and risk and compliance) where it strengthens a specific design review

Required Skills & Experience

• 10 or more years of cybersecurity or related IT analytical experience in an advisory, architecture, or governance capacity, not limited to hands-on security operations or tool administration
• Demonstrated enterprise identity and access management experience tied to a named program, employer, and outcome, not listed as a skill alone
• Demonstrated experience applying Zero Trust principles on a real program, translated into an actual design pattern or policy a team adopted
• Demonstrated ability to review a technical or architectural design against a defined standards framework and communicate findings to both peer technical staff and senior or executive stakeholders in the appropriate register for each audience
• Eligible to work in Canada without employer sponsorship
• Note on evidence standard: every requirement above must be visible in the candidate's job history with specific employers, projects, and deliverables; a skill listed in a technical skills section without corresponding job history does not satisfy the requirement

Preferred Skills

• Breadth across general cybersecurity domains beyond identity and Zero Trust: vulnerability management, SIEM, endpoint security, threat intelligence
• Comfort operating across hybrid and multi-cloud environments
• Current industry-recognized certification (CISSP, CCSP, TOGAF, or equivalent) where the underlying skill is also demonstrated in job history, not the certification standing alone
• Experience inside a large, complex enterprise with an established internal standards framework; specific industry background is not required