Senior Information Technology Security Engineer (Won Contract – Rate $1,025/day) Full Time

We are looking for a Senior Information Technology Security Engineer for Employment and Social Development Canada with a Security Clearance Level of Secret and Bilingual. It is a WON Contract and the rate is $1,025 per day.

The resource must meet all mandatory requirements and pass the rated requirements. The grid will be sent through email for review.

Mandatory Requirement

The IT Security Engineer resource MUST possess a degree, diploma or certificate from a recognized university or college in a related information technology discipline.

• A copy of the Diploma or Certificate MUST be provided included in the bidder’s proposal.
• At the time of bid closing, the Bidder MUST submit a detailed resume for the proposed resource demonstrating that they meet the minimum mandatory requirements (educational, professional designations and work experience) for their TBIPS resource category:
  • Stream 6: Cyber Protection Services Category C.6. Information Technology Security Engineer Level 3.
  • A Level 3 resource MUST have at least 10 years of experience.
• The Bidder MUST demonstrate clearly through detailed project descriptions, that the proposed resource possesses experience within the last 5 years preceding the time of bid closing date, in the role of IT Security Engineer, as per the list of deliverables below.
• The services MUST have included at least five (5) out of the following seven (7) experience categories:

1. a) Assess IT security tools, services, processes of application and operating system hardening according to industry best practices;
2. b) Manage the IT security configuration of systems and ensure that systems are operating with minimum security requirements as per industry best practice;
3. c) Provide independent verification and validation of IT systems and report on deviation from minimum security requirements settings;
4. d) Conduct reviews and analysis of IT security solutions and practices and report on risks and impact of deviations from good practices;
5. e) Conduct analysis of the preliminary and final findings and evaluate technical and non-technical areas and assess related risks;
6. f) Perform gap analysis, including scanning the IT security environment to identify and assess risks to determine and prioritize what requires management attention; and,
7. g) Apply IT security accepted methods and principles and conduct quality assurance over the development of IT solutions.

Tasks:

• Request and review documentation with regards to infrastructure plans, architecture plans, previous assessments and audits/related management action plans and roadmaps;
• Conduct and analyze interviews and prepare interview notes and follow-up questionnaires for interviews with auditees, as required;
• Conduct and analyze risk assessment results to identify technical and non-technical areas that the audit will focus on;
• Prepare the terms of reference of this engagement as per pre-determined ESDC templates or an auditability assessment depending on the risk assessment results;
• Develop a detailed engagement program/plan identifying each step of the methodology to conduct the audit work and how to collect the necessary evidence to determine adequacy of controls and risk management activities;
• Modify terms of reference and program documents based on comments received from project authority and during de-brief sessions (with auditees and/or audit management);
• Determine the audit scope and select a sample of the population under review for audit testing/assessments as required, specify criteria and rationale used to select the sample as required;
• Prepare testing plans and related rules of engagement documents to specify criteria of testing as required;
• Prepare questionnaires for conducting the work, including analysis sheets, for interviews with auditees (IT and non-IT) as required;
• Facilitate interviews, meetings, briefings and follow-ups as required;
• Analyze and produce analysis working papers such as functional and detail diagrams, installation documentation and other technical documentation to show results of the audit testing/assessment, include development of rules of engagement as required;
• Conduct interviews, meetings, briefings and follow-ups as required;
• Carry out the assessment of the environment under review as per the engagement program/plan, focusing on determining the adequacy of technical and operational controls of IT security;
• Conduct analysis of the preliminary and final findings and evaluate technical and non-technical areas and assess related risks;
• Present and communicate results of analysis to various management and technical audiences (with auditees and/or audit management), as required;
• Handoff and train on all aspects of the project to audit team, as required;
• Conduct a quality assurance for the work conducted and issue a quality assurance statement document.

If interested, please reach out to June at june@mdosconsulting.com