Business Analyst Cybersecurity

Highspring; Montreal; On-site; CAD 70,000 - 90,000; Full time

Job summary

Highspring is seeking a Cybersecurity Business Analyst to support roadmap development for the Data Protection pillar family, focusing on cryptography, PQC, and DLP, with CYBAI as priority. You will collaborate with Product Owners, security segments, and technical teams to gather requirements, assess risks, and prepare intake deliverables for 2027 demand management and budget processes.

Experience in SAFe, Jira, and Confluence is a plus.

Qualifications

• Proven business analysis experience with elicitation and documentation.
• Cybersecurity knowledge across risk, data protection and compliance.
• Ability to support technology transformations in cybersecurity projects.
• Coordinate multiple stakeholders and deliver structured results on tight timelines.
• Proficient with generative AI tools to accelerate docs and requirements.

Responsibilities

• Develop the 2027-2029 roadmap across four pillars.
• Perform business requirements analysis for post-quantum transition.
• Document migration scenarios and track requirements.
• Support risk assessment and prioritization of migration initiatives.
• Coordinate cross-functional collaboration between business and security.
• Define requirements for DLP and CYBAI pillars.
• Contribute to the 2026 control maturity assessment.
• Prepare intake deliverables for demand and budget processes.
• Coordinate stakeholders including Product Owners and partner units.

Skills

Business analysis

Cybersecurity knowledge

Tech modernization

Stakeholder coordination

AI tools for documentation

Tools

Jira

Confluence

Job description

The Data Protection (PDD) capability encompasses four complementary pillars: cryptography (PKI, certificate lifecycle management, and cryptographic platform resilience), data loss prevention (DLP), post-quantum cryptography (PQC), and artificial intelligence security (CYBAI).

As the capability begins its FY2027 planning cycle, it must develop its 2027-2029 roadmap across these four pillars. We are seeking a Cybersecurity Business Analyst to support roadmap development, the 2026 control maturity assessment, and intake deliverables for the 2027 demand management and budget assessment process. The immediate focus will be on cryptography and PQC, with support for the DLP and CYBAI pillars as priorities evolve.

The successful candidate will work closely with Product Owners (POs), security segments, technical teams, and partner business units.

Responsibilities

• Develop the 2027-2029 PDD roadmap across all four pillars: cryptography (PKI and certificate lifecycle management at scale, and cryptographic platform resilience), data loss prevention (DLP), post-quantum cryptography and cryptographic agility, and AI security (CYBAI).
• Business requirements analysis: Gather and formalize business needs and functional requirements related to the post-quantum transition and cryptographic agility; ensure alignment between standards and controls.
• Impact analysis: Document business processes and use cases affected by cryptographic changes in collaboration with technical teams.
• Risk management and prioritization support: Collect and organize the information required to assess quantum risks and prioritize migration initiatives.
• Transformation initiative coordination: Document migration scenarios, track requirements, and facilitate collaboration between business and security teams.
• Support for the DLP and CYBAI pillars: Help define requirements and document processes related to data loss prevention and AI security, based on capability priorities.
• Support the 2026 control maturity assessment across all four PDD pillars.
• Prepare intake deliverables for the 2027 demand management and budget assessment process.
• Coordinate stakeholders, including Product Owners, security segments, and partner business units.

Requirements

• Proven business analysis experience, including requirements elicitation and documentation, process documentation, and use case development.
• Cybersecurity knowledge: General understanding of security risks, data protection, and compliance considerations.
• Ability to support technology transformations: Experience with IT modernization projects, ideally in cybersecurity, and the ability to collaborate with multidisciplinary teams.
• Ability to coordinate multiple stakeholders and produce structured deliverables within tight timelines.
• Proficiency in using generative AI tools, such as GitHub Copilot and writing assistants, to accelerate documentation, synthesis, and requirements structuring.

Assets

• Experience in security or data protection.
• Exposure to cryptography, PKI, or certificate lifecycle management; in-depth cryptography expertise is not required.
• Exposure to data loss prevention (DLP) or artificial intelligence security.
• Familiarity with applicable regulatory frameworks and requirements, including OSFI B-13, E-21, E-23, and Québec's Law 25.
• Experience with the Scaled Agile Framework (SAFe), Jira, and Confluence.