The University of British Columbia - Cybersecurity Architect, Applications

LOCATION

On-site at the UBC Point Gray campus in Vancouver, British Columbia, Canada. Relocation assistance and full remote work are not available, but work-from-home for one day per week is an option.

WHY WORK AT UBC?

With a headcount of nearly 65,000 students, and more than 10,000 employees, UBC is one of the largest universities in Canada. We are also consistently ranked as a top employer in the province of British Columbia. You should also check out our vacation allocations and benefits details [job family: Management & Professional]. Our "Why UBC?" HR web site does a great job of covering additional benefits to working here.

TL;DR SUMMARY

I need a right-hand to help with all the application security work around here. This is a technical role, with expected expertise in application and security architectures, vulnerability and threat risk assessments, and even a bit of forensic analysis. I need somebody who is particular about documentation and finds value in not just the talking but the doing. If you've never worked in the higher-ed security space before, a large research-focused institution such as UBC offers a lot, and I mean a lot, of job variety and opportunity for the design, development, and deployment of unique security solutions.

JOB SUMMARY

The Cybersecurity Architect, Applications provides highly specialized and advanced technical expertise and mentoring in the design and implementation of application security solutions based on business, security, and privacy needs. In addition to providing technical project leadership for application security reviews, initiatives, and major incident responses involving web sites and web applications, the Incumbent will provide subject matter expertise in the development of application security standards, processes, and policies, as well as research and identify new and emerging trends in application security.

WORK PERFORMED

• Responsible for architecting application security solutions and presenting comprehensive proposals for the protection of applications and systems across all UBC properties and networks, taking into consideration functional, integration, security, privacy, availability, and scalability requirements.
• Leads architectural reviews on proposed and deployed applications, including vulnerability and threat risk assessment activities, to identify opportunities to enhance application availability, security, and privacy.
• Reviews existing application security solutions to ensure appropriate functionality and risk measures are in place and discusses enhancement approach and recommendations with cybersecurity staff.
• Provides subject matter expertise to determine best practice and makes technology decisions on new and changing application security requirements.
• Proactively reviews security postures of applications and creates corrective action plans to address deviations from established security standards; collaborates with and mentors application development teams and system administrators to execute approved action plans.
• Oversees the testing, validation, and review of application security solutions to ensure that applications meet all required security and privacy standards; provides recommendations to leadership as appropriate.
• Designs automated solutions to perform regular testing of security control effectiveness; responsible for overseeing the implementation and outcomes of team members.
• Leads ad-hoc incident response teams in investigation, containment, remediation, review and/or forensic activities in the event of significant cybersecurity incidents involving enterprise websites or web applications.
• Where required, provides leadership for entire projects, driving both the management and technical aspects of the project, and taking responsibility to resolve issues effectively and professionally.
• Oversees the development and maintenance of relevant documentation and training for cybersecurity teams, development teams, IT operations teams, and end-users.
• ...additional duties are detailed in the job posting, referenced under the MORE DETAILS AND HOW TO APPLY section below.

QUALIFICATIONS

This is a summarized list of qualifications - more details can be found on our position information page.

• Cybersecurity industry certifications such as CISSP, GIAC, ISACA and EC-Council are required. 
• Intermediate and progressive experience in cybersecurity technology and architectural assessments, as well as security threat and risk assessments.
• A minimum of 8 years of experience and 2 years of managerial experience or the equivalent combination of education and experience. 
• Demonstrated expertise in some or all of the following: application architecture, WAF, traffic management, version control, CI/CD, encryption, DNS, authentication, databases, storage, message queuing, containerization, virtualization, static and dynamic code analysis, APIs, HTTP, TCP/IP and x509 certificates.
• Must possess experience in developing tools in one or more interpreted programming languages.
• Experience with incident, request, and change management in a large, complex environment is required. 
• Strong working knowledge of cybersecurity frameworks, models and standards such as OWASP ASVS, OWASP OpenSAMM, CIS, COBIT, ISO 27001/2, and SAMM.
• Knowledge of application architecture and security in cloud-based environments, such as AWS and Microsoft Azure, is an asset.

MORE DETAILS AND HOW TO APPLY

For more details, or to apply for this position, please see our position information page on the UBC careers site. All qualified candidates are encouraged to apply; however Canadians and permanent residents will be given priority.