Security Information and Event Management

**Priority may be given to the following designated employment equity groups: women, Indigenous Peoples* (First Nations, Inuit and Métis), persons with disabilities and racialized persons*.**
- The _Employment Equity Act_, which is under review, uses the terminology Aboriginal peoples and visible minorities.

**City**: Ottawa

**Organizational Unit**: Knowledge, Information and Technology Services

**Classification**: CS-3

**Tenure**: Continuing

**Language Requirements**: English

**Work arrangements**: Due to the nature of the work and operational requirements, this position is eligible for a hybrid work arrangement (combination of working onsite and telework). Employees in this position who telework will be required to travel to the designated work site at least three times per week or a minimum of 60% of their regular work schedule at their own expense.

**Discover the possible**:
Anything is possible at the NRC, named in 2025 one of Canada’s Top Employers for Young People, Top Employer in the National Capital Region and Forbes Canada’s Best Employers

As Canada’s leading research and technology organization, our world-renowned research pushes the boundaries of science and engineering to make the impossible, possible. Every day we explore new ideas through innovative research and help companies discover possibilities that impact Canada’s future and the world.

At the NRC, you’ll also discover new possibilities. Our supportive workplace fosters a culture of creativity, welcoming fresh perspectives and innovation at all levels. We value teamwork. You’ll collaborate across multiple fields and with the brightest minds to find creative solutions. Most importantly, you’ll discover what’s possible within you as you grow, make valuable contributions and progress in your professional journey. From ground-breaking discoveries to a life-changing career, discover your possible at the NRC.

**The role**:
We are looking for a Security Information and Event Management (SIEM) and XDR Technical Advisor to support our Chief Information Officer Branch. The Technical Advisor, Cloud and Data Security would be someone who shares our core values of Integrity, Excellence, Respect and Creativity.

**The key activities for this position are the following**:

- Develop, implement, and manage the Security Information and Event Management (SIEM) platform to aggregate and correlate data from multiple security systems;
- Develop, implement, and manage the Extended Detection and Response (XDR) platform to improve the automation of vulnerability, event, and incident management as they relate to Identity, Endpoint, Network, Cloud, etc.;
- Develop, implement, and manage NRC’s Insider Threat and Data Loss Prevention (DLP) program in collaboration with NRC’s Information Management group;
- Coordinate the integration and the evolution of multiple cyber security tools on all NRC-managed assets into a comprehensive and coherent suite of tools;
- Configure dashboards and reports for cyber security events, incidents, and vulnerabilities;
- Establish key performance indicators to evaluate the effectiveness of NRC’s cyber defence strategy and to ensure that the Cyber Defence Team’s objectives are being achieved;
- Ensure the onboarding and integration of new NRC projects into cyber security services;
- Develop operational cyber security instruments (policies, directives, standards, guidelines, and configuration baselines) tailored to the NRC.
- Achieve and maintain industry standard security certification appropriate for the position.

**Screening criteria**:
**Education**:
A University or College degree in Computer Sciences or a College diploma in Computer sciences or an equivalent combination of experience and education

For information on certificates and diplomas issued abroad, please see Degree equivalency

**Experience**:

- Significant experience in the IM/IT field, specifically in roles related to cyber security within a Security Operations Center (SOC) or similar environment;
- Significant experience as a system administrator, particularly with cyber security tools such as antivirus, vulnerability management, detection and response, data loss prevention, etc.;
- Significant experience in event and incident management (i.e. preparation; detection and analysis; containment, eradication, and recovery; post-incident activity);
- Strong experience in scripting or programming;
- General experience in implementing adequate technical and organizational safeguards to protect IT assets, information, and the continuity of IT services;
- Experience in writing various types of documentation such as reports, briefing notes, technical guides, and standard operating procedures;

**Condition of employment**:
Secret (II)

A thorough security clearance process will be applied.

For a Secret Clearance, verification of background information over a period of 10 years is required. Individuals must have lived in Canada for a sufficient period of time to enab