Cyber Security Analyst- SA&A

Summary

We are looking for a Cybersecurity Analyst with expertise in Security Assessment and Authorization (SA&A) to join our Professional Services Delivery team. In this role, you will play a key part in assessing security controls, ensuring compliance, and supporting projects aligned with ITSG‑33 and Government of Canada security standards. This position requires hands‑on experience conducting security assessments, preparing SA&A documentation, and working within Government of Canada security frameworks.

A valid Government of Canada PSPC Security Clearance at the SECRET (Level II) level is required.

Key Responsibilities

• Execute Security Assessment & Authorization (SA&A) activities for Government of Canada IT projects.
• Develop and maintain security documentation, including High Level Designs (HLDs), Detailed Security Design Documents (CONOPS, Access Control Methods), and other security artifacts.
• Ensure compliance with Government of Canada security standards, Shared Services Canada (SSC) policies, and ITSG‑33 guidelines.
• Conduct security readiness assessments and guide projects through the process to obtain Authority to Operate (ATO).
• Collaborate with project teams, system owners, and security stakeholders to identify and mitigate risks.
• Provide expert advice on security controls, threat modeling, and vulnerability management.
• Work directly with Customer Technical Leads, Bell Technical Leads, and internal teams to deliver successful technical security solutions aligned with project timelines.
• Provide technical support services to develop, integrate, and maintain end‑to‑end security solutions.
• Ensure all security documentation aligns with SSC frameworks and government procurement requirements.
• Contribute to the continuous growth of the BBM Public Sector Practice by identifying opportunities and supporting new security solution development.
• Demonstrate strong ownership of outcomes, the ability to learn quickly, and deliver on time.
• Assist with presales activities, including SoW development, RFP responses, and level‑of‑effort estimates.
• Participate in technical training on emerging technologies and integrate new capabilities into solutions.
• Build strong relationships across departments and work effectively at all levels of the organization

Critical Qualifications

• 2–5 years of experience delivering security projects within government or enterprise environments.
• Strong desire to learn, adapt, and implement new technologies.
• Proven ability to manage multiple projects simultaneously and meet tight timelines.
• Excellent written, presentation, and communication skills.
• Ability to communicate technical concepts clearly to technical teams, end users, and management audiences.
• Demonstrated ability to work both collaboratively within a team and independently with minimal supervision.
• Willingness to travel occasionally within Canada based on project needs.
• Ability and willingness to obtain Secret, Top Secret, or Special Access Security Clearance issued by a Government of Canada agency (or equivalent).

Preferred Qualifications

• Experience working with Security Assessment & Authorization (SA&A) processes and achieving Authority to Operate (ATO) for Government of Canada systems.
• Strong knowledge of ITSG‑33, Government of Canada security policies, and Shared Services Canada (SSC) compliance requirements.
• Familiarity with cloud and on‑premises environments, including hands‑on experience with security control implementation.
• Proven ability to produce high‑quality security documentation for large‑scale IT projects in government or enterprise settings.
• Excellent communication skills with the ability to effectively engage with multiple stakeholders and technical teams.
• Bilingual (English/French) capability is considered a strong asset.
• Experience providing security best‑practice recommendations related to assessment, security architecture, or solution implementation.
• Degree or Diploma in Computer Science, Systems Engineering, IT Security, or a related field.
• Professional certifications such as CISSP, CISM, OSCP, CISA, CCIE, or equivalent credentials are considered an asset