General Description
\n\nThe IT Cybersecurity Consultant – Level 2 supports activities that identify, reduce, and mitigate cybersecurity risks to protect critical information infrastructure and ensure compliance with applicable cybersecurity regulations, policies, and industry standards.
\n\nThe role focuses on cybersecurity policy development and maintenance, governance, risk assessment, compliance, and security operations. The consultant works with technology teams, project managers, business stakeholders, and cybersecurity specialists to identify control gaps, translate technical and regulatory requirements into actionable policies, and continuously improve the organization’s cybersecurity posture.
\n\nExperience and Role Accountabilities
\n\nIdentify potential cybersecurity risks and incidents through vulnerability assessments, security log monitoring, and collaboration with internal teams and stakeholders.
\n\t\n\tAssess security test results, evaluate the impact of identified risks, validate baseline security configurations, and recommend appropriate remediation options for operating systems, applications, networks, and telecommunications equipment.
\n\t\n\tDevelop, review, and maintain cybersecurity policies, standards, guidelines, and procedures aligned with organizational requirements, applicable regulatory obligations, and industry best practices.
\n\t\n\tIdentify control gaps, outdated or overlapping requirements, and opportunities to improve cybersecurity policies, standards, and control frameworks.
\n\t\n\tTranslate cybersecurity risks, regulatory obligations, and technical requirements into clear, concise, and actionable policy language.
\n\t\n\tApply knowledge of cybersecurity frameworks and standards, including NIST Cybersecurity Framework (CSF), NIST SP 800-53 Revision 5, Risk Management Framework (RMF), AI Risk Management Framework (AI RMF), COBIT, and ISO/IEC 27001 and 27002.
\n\t\n\tProvide cybersecurity governance and policy guidance to projects, technology teams, and business stakeholders to support the consistent application of security requirements and best practices.
\n\t\n\tConduct compliance impact assessments and advise project managers and technical teams on cybersecurity-related requirements, risks, and mitigation measures.
\n\t\n\tSupport cybersecurity and compliance programs and initiatives, including governance, risk management, policy development, control assessments, and related compliance activities.
\n\t\n\tAssist with security design, security testing, implementation support, and the transition of new security systems and technologies from project delivery into ongoing operations.
\n\t\n\tSupport security incident response activities by preparing incident reports, documenting security findings, and collaborating with incident response leads and subject matter experts.
\n\t\n\tReview existing security controls, event data, and other relevant information to identify opportunities to improve threat detection, cybersecurity effectiveness, and control maturity.
\n\t\n\tContribute to the development and continuous improvement of cybersecurity standards, guidelines, operating procedures, and governance practices.
\n\t\n\tAssess cybersecurity risks associated with cloud technologies and artificial intelligence (AI), supporting the implementation of appropriate security controls and risk management practices.
\n\t\n\tCommunicate cybersecurity risks, policy requirements, compliance findings, and recommendations effectively to technical and non-technical stakeholders.
\n\t\nEducation and Skills
\n\nBachelor’s degree or technical diploma in Computer Science, Information Security, Information Technology, or an equivalent field.
\n\t\n\tStrong knowledge of cybersecurity governance, risk management, compliance, and policy development.
\n\t\n\tKnowledge and experience with cybersecurity frameworks and standards, including:
\n\n\tNIST Cybersecurity Framework (CSF)
\n\t\t\n\t\tNIST SP 800-53 Revision 5
\n\t\t\n\t\tNIST Risk Management Framework (RMF)
\n\t\t\n\t\tNIST AI Risk Management Framework (AI RMF)
\n\t\t\n\t\tISO/IEC 27001 and ISO/IEC 27002
\n\t\t\n\t\tCOBIT
\n\t\t\n\t\tCloud security and AI risk management principles
\n\t\t\n\tWorking knowledge of IT processes and security controls, including:
\n\n\tNetwork architecture and security
\n\t\t\n\t\tActive Directory and identity management
\n\t\t\n\t\tSecurity log management and continuous monitoring
\n\t\t\n\t\tVulnerability scanning and penetration testing
\n\t\t\n\t\tAuditing, configuration management, and asset management
\n\t\t\n\t\tInternet policy enforcement and web content filtering
\n\t\t\n\t\tEncryption and strong authentication
\n\t\t\n\tKnowledge of security technologies, including:
\n\n\tIntrusion Detection and Prevention Systems (IDS/IPS)
\n\t\t\n\t\tWireless Intrusion Detection and Prevention Systems (WIDS/WIPS)
\n\t\t\n\t\tSecurity Information and Event Management (SIEM)
\n\t\t\n\t\tVirtual Private Networks (VPNs)
\n\t\t\n\t\tNext-Generation Firewalls (NGFW) and Web Application Firewalls (WAF)
\n\t\t\n\t\tDatabase Activity Monitoring (DAM)
\n\t\t\n\t\tPublic Key Infrastructure (PKI)
\n\t\t\n\t\tData Loss Prevention (DLP)
\n\t\t\n\t\tIdentity and Access Management (IAM) solutions
\n\t\t\n\tUnderstanding of relevant privacy and regulatory requirements, including British Columbia’s Freedom of Information and Protection of Privacy Act (BC FIPPA) and North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) standards.
\n\t\n\tAbility to identify control deficiencies, evaluate risks, interpret technical and regulatory requirements, and develop practical policy recommendations.
\n\t\n\tStrong analytical, documentation, problem-solving, and stakeholder collaboration skills.
\n\t\n\tExcellent written and verbal communication skills in a professional environment.
\n\t\n\tAbility to obtain a security clearance for a Security Sensitive Position classification.
\n\t\nMust-Have Qualifications
\n\nA minimum of five (5) years of experience in Information Technology, including at least three (3) years in cybersecurity or a related field.
\n\t\n\tKnowledge and experience with NIST CSF, NIST SP 800-53 Revision 5, RMF, AI RMF, COBIT, ISO/IEC 27001/27002, cloud security, and AI risk.
\n\t\n\tDemonstrated ability to identify control gaps, outdated or overlapping requirements, and opportunities for improvement.
\n\t\n\tAbility to translate cybersecurity risks, regulatory obligations, and technical requirements into clear, concise, and actionable policy language.
\n\t\n\tExperience developing, reviewing, and maintaining cybersecurity policies, standards, and guidelines aligned with organizational requirements, applicable regulations, and industry best practices.
\n\t\n\tAbility to provide cybersecurity governance and policy guidance to projects, technology teams, and business stakeholders.
\n\t\n\tExperience supporting cybersecurity and compliance programs, including related governance, risk management, and policy activities.
\n\t\nNice-to-Have Qualifications
\n\nA minimum of seven (7) years of Information Technology experience, including at least five (5) years of cybersecurity or related experience.
\n\t\n\tA minimum of two (2) years of experience in cybersecurity policy development, review, and maintenance.
\n\t\n\tExperience in cybersecurity governance, risk, and compliance (GRC), as well as cybersecurity operations.
\n\t\n\tProfessional cybersecurity certification, such as:
\n\n\tCertified Information Systems Security Professional (CISSP)
\n\t\t\n\t\tCertified Information Security Manager (CISM)
\n\t\t\n\t\tCertified Information Systems Auditor (CISA)
\n\t\t\n\t\tCertified Cloud Security Professional (CCSP)
\n\t\t\n\t\tAn equivalent recognized cybersecurity certification
\n\t\t\n\tExperience working with Operational Technology (OT) environments or NERC CIP compliance.
\n\t\n