Application Architect

Position: Application Architect

Location: Toronto, ON (Hybrid)

Duration: 6+ months

Software-defined networking (SDN) and SD-WAN (Software-defined Wide Area Network)

Secure Access Service Edge (SASE)

MITRE Telecommunication&CK framework

Zero-trust architecture (ZTA)

Cloud security architecture

Various vendor specific architectures and frameworks (e.g., Azure Security Architecture, Google infrastructure security, AWS cloud security architecture)

NIST Cyber Security Framework v2

CIS Controls v8

Security Operation (SecOps) practices

Providing subject matter expertise, solution and architecture advice, consultancy, training and implementation guidance with cyber security, network security and network protection solutions, including:

Next-generation cyber security technologies leveraging automation, artificial intelligence (AI) and machine learning (Client)

Endpoint security solutions - Endpoint protection (EPP), Endpoint detection and response (EDR), and Extended Detection and Response (XDR)

Cloud-based cyber security solutions, Secure Service Edge (SSE) / SASE, including Secure Web Gateway (SWG), Cloud Access Security Broker (CASB) and Zero-Trust Network

Identity security solutions – such as Multi-Factor Authentication (MFA), Passkey, Identity Management (IdM), and Privileged Access Management (PAM)

Advanced intrusion prevention systems (IPS) and intrusion detection systems (IDS)

Network access control

Incident Response and Incident Management (IR and IM) systems

Automated vulnerability and patching

Penetration testing and automated Red Teaming

User and Entity Behaviour Analytics (UEBA)

Distributed denial of service (DDoS) protection

Operation Technology (OT) security

Providing subject matter expertise, advice, consultancy, training, and implementation guidance on logging, securing and analysing data, vulnerability scanning and penetration testing, and risk assessments to ensure sound network security architecture

Providing subject matter expertise, advice and consultancy on complex cyber security and network security issues

Providing subject matter expertise, advice, consultancy, training and implementation guidance with network operations centre (NOC) and security operations centre (SOC) technologies, services, and equipment including, but not limited to:

Security Information and Event Management (SIEM)

Security Orchestration, Automation and Response (SOAR)

Threat Intelligence

(SASE

SolarWinds NetFlow Traffic Analyzer

Network Performance Monitor (NPM) and Network Configuration Management (NCM) Tools

Providing subject matter expertise, advice, consultancy, training and implementation guidance with identity security and authentication solutions and technologies for:

Password-based and passwordless authentication

MFA

Certificate-based authentication

Biometric authentication

Staying abreast of the ever-evolving cyber threat landscape to provide subject matter expertise, guidance and advice on tactical and operational cyber security and network security practices

Developing strategic technology roadmaps based on new and emerging cyber security and network security architecture solutions, technology trends and industry analysis.

Developing strategic technology roadmaps based on new and emerging network architecture solutions and technology trends and industry analysis, including, but not limited to:

Network function virtualization (NFV), Open Network Automation Platform (ONAP), etc.

Wi-Fi and cellular broadband adoption

Wi-Fi 6 (802.11ax), 802.11ay, Wi-Fi 7 (802.11be)

WISP tools, technologies and implementation in Ontario

5G (5th generation) mobile data service, spectrum sharing, splicing, etc.

Wireless network security practices including authentication and edge security

Providing subject matter expertise, advice, consultancy, training and implementation guidance of network technology solutions, services and equipment including, but not limited to, software-defined networking (SDN) technology:

SD-WAN (e.g. Fortinet, Cisco Meraki, Palo Alto, etc.)

Emerging SD-Edge such as VMware VeloCloud, Silver Peak, etc.

Cyber Security and Network Security

10+ years’ experience in advanced SD networks and network security – preferably for Ontario K-12 school boards

10+ years’ knowledge and experience with cyber security, network security and network protection architectures, frameworks, and solutions, including:

Software-defined networking (SDN) and SD-WAN (Software-defined Wide Area Network)

Secure Access Service Edge (SASE)

MITRE Telecommunication&CK framework

Zero-trust architecture (ZTA)

Cloud security architecture

Various vendor specific architecture and frameworks (e.g., Azure Security Architecture, Google infrastructure security, AWS cloud security architecture)

10+ years hands-on experience providing subject matter expertise and leading implementation of network security and network protection solutions and technologies implementation– preferably for Ontario K-12 school boards, including:

Next-generation cyber security technologies leveraging automation, artificial intelligence (AI) and machine learning (Client)

Next-generation firewalls (specifically Fortinet, Meraki, Palo Alto),

Network access control (e.g., HPE Aruba ClearPass, FortiNAC),

Security Information and Event Management (SIEM) and Security Orchestration, Automation and Response (SOAR) including Microsoft Sentinel, Splunk, Google Chronicle, and FortiSIEM

Endpoint security solutions - Endpoint protection (EPP), Endpoint detection and response (EDR), Extended Detection and Response (XDR)

Cloud-based cyber security solutions such as Secure Web Gateway (SWG), Cloud Access Security Broker (CASB) ,firewalls, and Zero-Trust Network access as available SASE (such as Zscaler, Netskope, Cisco Umbrella, etc.),

Distributed denial of service (DDoS) protection,

Advanced intrusion prevention systems (IPS), and intrusion detection systems (IDS)

Identity Management (IdM), Privileged Access Management and other identity security solutions

Automated patching solutions

Incident Response (IR) and Incident Management (IM)

Operation Technology (OT) security

10 + years hands-on experience providing subject matter expertise and leading implementation of authentication solutions and technologies - preferably for Ontario K-12 school boards, including:

Password-based and passwordless authentication

Multi-factor authentication (MFA)

Certificate-based authentication

Biometric authentication (e.g., Fast Identity online (FIDO) Universal 2nd Factor (U2F), FIDO2, Google Authenticator, Security Assertion Markup Language (SAML))

2+ years demonstrated hands-on experience providing security operations center (SOC) design, architecture and plans including SOC technologies, services, and equipment, but not limited to:

SIEM

SOAR

SASE

Demonstrated hands-on experience with cyber security industry frameworks such as NIST Cyber Protection Framework and 800 series, CIS Controls v8, COBIT and ISO 27001

Knowledge of the new draft NIST Cyber Security Framework v2.0

Excellent knowledge of the new and emerging cyber security and network security technology trends

Excellent knowledge and exposure to IoT security issues and data capturing mechanisms

Network Technology

10+ years hands-on experience with network infrastructure solutions and technologies including LAN/WAN, VPN, VXLAN, wLAN, fog computing, network function virtualization (NFV), server virtualization, cloud platforms, and hardware (servers, switches, routers, firewalls)

5+ years’ hands-on experience with software-defined networking (SDN, SD-WAN, SD-Edge)

5+ years’ hands-on experience with Ontario K-12 school boards’ networks (WAN, LAN, Wi-Fi, internet service delivery)

5+ years’ hands-on experience in data and performance monitoring and management systems, in particular, SolarWinds, FortiManager, Meraki, Panorama, Wireshark – preferably for Ontario K-12 school boards

5+ years’ hands-on experience with network data traffic awareness, monitoring and analysis tools and technologies, and enterprise tools, including SolarWinds, PRTG (Paessler Router Traffic Grapher) and Wireshark Network Analyzer – preferably for Ontario K-12 school boards

5+ years’ hands-on experience with data logging mechanisms and technologies including Syslog, IPFix, CSV, CEF and NetFlow – preferably for Ontario K-12 school boards

Demonstrated hands-on experience with developing customized WAN and network architectures for SDN networks to address unique and specific needs

Excellent knowledge of the new and emerging network technology trends

Demonstrated experience assessing and evaluating new and emerging network technologies with pilots and proof-of concepts

Experience with telecommunication technologies such as:

Data transport technologies including fibre optic cable, coaxial cable, wireless, radio and microwave

Next-generation data transport such as LTE Advanced, DOCSIS C3.1, and 5G

Transmission protocols including Multiprotocol Label Switching (MPLS), Virtual Private LAN Service (VPLS), TCP/IP (Transmission Control Protocol/Internet Protocol) and tunneling

Coordination Skills and Experience

Strong communication skills as demonstrated through:

5+ years’ experience in effectively presenting to management teams and external stakeholders

5+ years’ experience in preparing written materials (e.g., status reports, recommendations, briefing notes)

5+ years’ coordinating complex technical work with multiple IT teams, internal and external to the Ministry

Industry Certifications / Relevant Degrees

Relevant network certifications or equivalent work experience

Relevant security certification required (e.g., CISSP or CISM).

Computer Science, engineering or other relevant degree is required.

Postgraduate degree (e.g., M.Sc. and/or Ph.D.) in computer science or engineering is preferred.