Cybersecurity Analyst II

Discover TRIUMF , Canada's particle accelerator centre. We are a publicly funded, not-for-profit research lab that is a hub for discovery and innovation.

Our mission is to serve as Canada’s particle accelerator centre.  We advance isotope science and technology, both fundamental and applied.  We collaborate across communities and disciplines, from nuclear and particle physics to the life and material sciences.  We discover and innovate, inspire and educate, creating knowledge and opportunity for all.

TRIUMF's diverse community of nearly 600 multidisciplinary researchers, engineers, technicians, tradespeople, staff, and students create a unique incubator for Canadian excellence, as well as a portal to premier global collaborations.  Fueling innovation and improving lives, we are committed to accelerating discovery and shaping a better world.

Are you a cybersecurity professional with 5+ years of hands-on experience in technical risk, security architecture, detection engineering, or identity security?

You could be a great fit if you bring:

• Cybersecurity risk expertise: Lead technical security risk assessments across systems, applications, infrastructure, and projects, identifying vulnerabilities and evaluating whether security controls can effectively prevent or detect real-world attacks

• Security architecture expertise: Review networks, cloud environments, applications, and enterprise systems to identify security weaknesses, assess data flows, perform threat modeling, and provide secure design guidance

• Detection engineering: Develop, test, maintain, and improve SIEM, EDR, and other security detection content, while mapping detection coverage to the MITRE ATT&CK framework and addressing security gaps

• Identity & access management: Assess and strengthen IAM environments, including MFA, SSO, privileged access management, federation, directory services, and zero-trust access controls

• Incident response & investigation: Provide senior technical support during complex cybersecurity incidents, from detection and triage through containment, recovery, and root cause analysis

• Vulnerability & threat intelligence: Evaluate vulnerabilities based on exploitability and asset criticality, monitor emerging threats, and translate threat intelligence into practical security improvements

• Technical leadership & mentorship: Serve as a senior technical resource, providing guidance, coaching, and work review for junior and intermediate cybersecurity analysts

Why TRIUMF?

• Work at Canada’s national particle accelerator centre and contribute to cybersecurity in a unique scientific research environment

• Collaborate with a multidisciplinary community of researchers, engineers, technicians, IT professionals, and scientists

• Grow your career through technical leadership, mentorship, continuous learning, and exposure to advanced research environments

• Enjoy a comprehensive total rewards package, including employer-paid health and dental benefits, vision care, pension, disability benefits, wellness benefits, and generous time away

PRIMARY FUNCTION

The Cybersecurity Analyst II applies deep technical expertise across a broad range of cybersecurity disciplines to evaluate and reduce risk across the organization's systems, infrastructure, and projects. The primary focus of the role is technical risk assessment and security architecture review, examining how systems are built, how they could be attacked, and whether controls in place would actually stop an adversary. In addition, the incumbent owns detection engineering and identity and access management security as core functions, ensuring the organization's defensive capabilities are built on sound design and continuously strengthened. The incumbent operates with minimal direction, exercises independent judgment on complex and ambiguous problems, and is trusted to make sound, technically grounded security decisions.

The ideal candidate thinks like an attacker and advises like a trusted advisor. They bring hands-on experience across threat modeling, attack surface analysis, detection content development, identity security architecture, and incident response, and can translate technical risk clearly and credibly to project teams, system owners, and leadership. This role also serves as a senior technical resource for the broader cybersecurity team, providing mentorship and guidance to junior analysts.

ORGANIZATIONAL RELATIONSHIPS

The Cybersecurity Team is a group of the Information Systems and Technology Department (IS&T). The Cybersecurity Analyst II reports directly to the Group Leader, Cybersecurity, and interacts on a day-to-day basis with other members of IS&T and with a broad range of internal stakeholders, system owners, and research groups. This position works with colleagues across all areas of the Lab and in all job functions. External contacts include vendors, consultants, and support service providers.

RESPONSIBILITIES

Technical Risk Assessment

• Lead technical cybersecurity risk assessments of systems, applications, infrastructure, and projects.

• Evaluate control effectiveness to determine whether existing safeguards would realistically detect or prevent an attack.

• Evaluate third-party and vendor security posture prior to onboarding and on an ongoing basis.

• Communicate risk findings with technical precision to technical stakeholders and in plain institutional impact terms to non-technical stakeholders.

• Contribute to risk reporting for governance and leadership forums as a secondary output of technical work.

Security Architecture Review

• Review the security design of proposed and existing systems, networks, applications, and cloud deployments.

• Assess data flows and sensitive data exposure risks as part of architecture reviews, escalating findings to the appropriate owner.

• Perform threat modeling to identify attack paths, trust boundary weaknesses, and exploitable design flaws.

• Provide secure design guidance to engineering and infrastructure teams throughout project lifecycles.

• Participate in change management processes to assess the security implications of infrastructure and application changes.

Detection Engineering

• Own the development and lifecycle management of detection content across SIEM, EDR, and other detection platforms, including writing, testing, validating, and maintaining detection logic

• Map and maintain detection coverage against the MITRE ATT&CK framework, identifying blind spots and prioritizing new detection development based on realistic threat scenarios for the organization.

• Translate threat intelligence, adversary TTPs, and post-incident findings into new detection use cases, building coverage where gaps exist.

• Document detection logic, tuning rationale, and coverage decisions to support team knowledge transfer and audit requirements.

Identity and Access Management Security

• Own the security architecture and risk posture of the organization's identity and access management environment, including authentication systems, privileged access management, SSO, federation, and directory services.

• Evaluate IAM designs and configurations, assessing authentication strength, privilege scope, and susceptibility to identity-based attacks such as credential theft, lateral movement, and privilege escalation.

• Lead or contribute to zero trust identity initiatives, including least-privilege access design, conditional access policy review, and MFA coverage.

• Identify and drive remediation of identity architecture weaknesses surfaced through risk assessments, architecture reviews, or incident investigations.

Incident Response and Security Operations

• Lead or provide senior technical support for complex or high-severity cybersecurity incident investigations.

• Guide and mentor junior analysts through triage, containment, eradication, and recovery.

• Lead post-incident reviews and root cause analysis, identify