Position purpose:

Provides expertise and leadership in the development of cybersecurity solutions for the uOttawa-IBM Cyber Range. Contributes to strategic planning and development and plays a vital role in the design, development, and implementation of an overall security risk management strategy for the Cyber Range; this includes developing simulation and testing protocols over a variety of complex systems. Directs and manages a team of skilled technical engineers. Provides security operations management for users, both internal and external. Supports the research team in developing, maintaining, and enhancing the proof-of-concept tool.  
The uOttawa-IBM Cyber Range is a unique learning, training and research facility that allows students, researchers, and companies to work in a realistic and immersive environment to learn how to protect against cybersecurity threats.

In this role, your responsibilities will include:

Security Risk Management: Develops and maintains a comprehensive cyber risk management framework. Continuously identifies, assesses, and mitigates client cyber risk exposure; implements and maintains robust risk management practices. Understands malware kill chain & hands-on-keyboard attacks.

Vulnerability Assessment: Conducts regular security assessments and identifies vulnerabilities with the systems. Detects accurate & efficient classification of malicious & suspicious behaviors. Elements include (but not limited to) mapping Indicators of Compromise (IOCs) to MITRE Att&ck matrix; configures author classification rules, for both Endpoint & Cloud scenarios, to identify malicious & suspicious use of Tactics, Techniques and Procedures (TTPs).

Risk Analysis and Mitigation: Assesses potential risks and develops strategies to mitigate these risks for the Cyber Range. Analyzes real-world kill chains to discover new TTPs and gaps in coverage. Evaluates the impact of different threats and devises plans to counteract them. Builds & maintains playbooks on threat actor TTPs.

Team Lead: Directs and manages a team of skilled technical staff. Oversees security operations including continuous security monitoring, incident response and remediation, and the use of threat intelligence to ensure timely detection and mitigation of cyber threats, risks, and vulnerabilities.

Customer Engagement: Serves as the primary cybersecurity contact with users and clients. Provides expert advice and support to clients on cybersecurity matters and ensures a high level of customer satisfaction with Cyber Range solutions. Contributes to active engagement with the security ecosystem through papers, presentations, and blogs.

Monitoring Systems: Continuously monitors networks and systems for potential security breaches or suspicious activities. This involves analyzing logs and reports generated by security tools to detect anomalies. Measures and tunes TTP coverage through data mining, customer telemetry & internal sandbox feeds.

Development of Security Protocols: Creates and implements security protocols and best practices to fortify the Cyber Range’s defenses. This includes building realistic training scenarios based on known and newly identified TTPs. Builds and maintains complex realistic simulation of large, virtualized networks on both CITEF and Field Effect.

What you will bring:

• PhD in Computer Science, Information Technology, or a related field, with a specialization in Cybersecurity and Artificial Intelligence
• Minimum 10 years’ experience in cybersecurity, software development lifecycle, large-scale computing, modelling, and/or anomaly detection
• Specialization or working experience in at least one of the following domains: penetration testing, forensics investigation, malware analysis
• Experience in leading a team of skilled technical staff
• Ability in providing feedback to project teams in non-technical terms and to communicate technical concepts to users
• Academically recognized author of security research papers
• Understanding and deep knowledge of commonly used attack tools and frameworks used by Red team
• Security Operations Center (SOC) or blue team experience involving the hunting and discovery of adversaries in enterprise environments
• Experience working with and manipulating large data sets (i.e. billions of events per day). 
• Experience with a background in the modern attacker kill-chain, MITRE ATT&CK, and emerging enterprise threats including attacks against AI systems.
• Proficiency in at least one programming language such as Python, C#, or C++
• Proficiency in at least one query language such as KQL, SQL, Cypher.
• Proficiency in virtualization and containerization technologies
• Experience with Ansible
• Expert Linux user
• Knowledge of project management concepts and methods and experience in planning and managing cross functional projects and teams
• Training in teaching (train the trainer) and/or teaching experience considered an asset
• Bilingualism - French and English (spoken and written)