Cybersecurity Architecture Expert Advisor

Trace your career path within the Business Technology team

We are an essential partner and a lever for transformation for Investissement Québec through our technological products and services. Our team ensures the operation, improvement, and transformation of Investissement Québec's information assets in a strategic and effective manner.

Your role:

The Cybersecurity Architecture Expert Advisor designs and validates the security architecture of Investissement Québec's solutions, with a particular focus on Azure cloud security. They translate risk and compliance requirements into concrete security design, from project scoping to implementation validation, and carry out cloud security controls. They serve as a technical reference for project teams, IT, and management, and evolve the Company's security standards and patterns.

Your main responsibilities

• Model the threat landscape of solutions: decompose the architecture, identify attack surfaces, threat scenarios, and countermeasures, aligning with business, solution, and functional architectures.
• Conduct security risk analysis based on threats and classification, and deliver risk side, mitigation plans, accepted residual risks, and exemptions.
• Classify project assets and data according to the DIC (Disponibilité, Intégrité, and Confidentialité) model, determine the required protection level, and the minimal controls that follow.
• Perform and oversee Privacy Impact Assessments (PIAs) of solutions, identify risks related to personal information protection, and recommend appropriate mitigation measures.
• Design the solution's security design: authentication and federation, encryption at rest and in transit, network segmentation, logging and monitoring, secret management.
• Validate security at project milestones, such as architecture reviews and security gates, and confirm that the implementation complies with the approved design.
• Integrate security requirements from the design phase, following the security by design principle.
• Design secure cloud architectures and Azure landing zones compliant with the Company's standards.
• Define and maintain the cloud security posture with Cloud Security Posture Management (CSPM) capabilities, a unified platform designed to protect cloud-native applications (CNAPP), and prioritize remediation of gaps.
• Secure IaaS, PaaS, and SaaS services, and establish governance (policies) governing cloud usage.
• Design and integrate AI solution security controls: data protection, access control, logging, and usage governance.
• Design cloud identity and access in Microsoft Entra ID, including privileged access management.
• Manage cloud encryption and secrets, and align cloud logging with Microsoft Sentinel.
• Apply Zero Trust (NIST SP 800-207) principles to cloud architecture and solutions.
• Produce reusable reference architectures and security patterns, including cloud patterns.
• Evaluate solution compliance with internal guidelines, including P1503 (Security Policy), NIST CSF 2.0 framework, and cloud security frameworks (CSA Cloud Controls Matrix, CIS Azure and Microsoft 365 benchmarks).
• Advise and influence project teams, IT, and management, and communicate risk concerns to support documented decisions.
• Stay current with technological advancements and evolve the Company's security standards and requirements.

Your specific qualifications required

• Bachelor's degree in computer science or equivalent. A master's degree in information technology is an asset.
• At least eight (8) years of experience in information security, including several years in security architecture and cloud security.
• Desired certifications: CISSP, CCSP, and Azure Security (AZ-500). Certifications CISSP-ISSAP, SABSA, and TOGAF are assets.
• Proven experience in solution security architecture and cloud security design on the Microsoft Azure stack (Defender for Cloud, Entra ID, Key Vault, Sentinel).
• Mastery of threat modeling, risk analysis, identity and access management, cryptography, and Zero Trust principles.
• Knowledge of AI security: securing AI solutions and services, model-specific risks, and responsible use of approved AI tools.
• In-depth knowledge of frameworks: NIST CSF 2.0 and NIST 800-53, ISO/IEC 27001 and 27002, CIS, OWASP, and CSA Cloud Controls Matrix.
• Experience in application security and secure development, integrated into the development lifecycle.
• Experience in a financial environment is an important asset.
• Investissement Québec offers several benefits

Connect with your colleagues: Hybrid work model. Enjoy the energy of the office to create, inspire, collaborate, and have fun! Several flexible scheduling options allow you to better balance your personal and professional life while respecting your employment profile.

• Avoid traffic by working according to a flexible schedule.
• Enjoy paid Friday afternoon off twice during the summer.
• Benefit from 3 full weeks of remote work per year.

Develop yourself: Several options are available to enhance your knowledge, improve your professional skills, or develop your management abilities. In addition, there are study leave, reimbursement of professional certification fees, course material reimbursement, and more.

Take care of your health: We offer free telemedicine services. Our TonIQ health and well-being program also allows you to benefit from conferences and activity suggestions promoting a healthy work-life balance.

Stay active: We reimburse a portion of your physical health program registration fees.

Feel supported in all circumstances: Our Employee and Family Assistance Program provides free, immediate, and confidential support.

Achieve now and prepare for your future at the same time! Our employees automatically enroll in our defined benefit pension plan, one of the most generous in our industry.

Be assured, you will be insured: We offer flexible collective insurance plans that can be tailored to your needs (subject to eligibility).

See life in green: Several sustainability initiatives are added to our balance sheet each year: reimbursement of a portion of your transit passes, free bike parking, water dispensers to reduce plastic waste.