Cybersecurity Operations Engineer

hydroottawa; Ottawa; On-site; CAD 90,000 - 120,000; Full time

Job summary

Hydro Ottawa is seeking a Cybersecurity Operations Engineer to design, automate, and maintain the cybersecurity architecture across corporate applications and infrastructure. You will build and manage automated workflows to proactively prevent and detect threats, while supporting incident response and policy-driven security controls.

Under the Cybersecurity Supervisor, you will serve as a technical resource for system integrations, log analysis, and security operations, ensuring compliance

Qualifications

• Experience designing and implementing cybersecurity solutions.
• Ability to analyze security events and respond to incidents.
• Familiarity with automation of security tasks and workflows.
• Understanding of security architectures and policy enforcement.

Responsibilities

• Architect, test and implement secure integrations between software and IT infrastructure.
• Develop automated playbooks to harden infrastructure against threats.
• Investigate security detections and manage data sources with the SOC.
• Support and guide internal units on authentication and vulnerabilities.

Skills

Incident response

Threat detection

Automation

Security architectures

Tools

PowerShell

Python

Bash

Job description

At Hydro Ottawa, we empower the lives of the people in the communities we serve.

We help to power your professional growth at every step of your engineering career. For those starting out, we provide the training and skills needed to achieve your P.Eng. designation, and for established engineers, our structured framework offers a clear, transparent pathways to intermediate and senior levels. Wherever you are in your career, there's a path for growth ahead of you here.

As the electricity distributor to the Nation's Capital, our work powers the essential activities that make up our lives - at home, at work and at play. And as Ontario's largest municipally-owned producer of green power, we are leading the way to a greener tomorrow.

We are seeking a Cybersecurity Operations Engineer, a strategic thinker who can take initiatives from concept to completion and engineer the way to a smart energy future.

Are you ready to make a difference in our community?

JOB SUMMARY

The Cybersecurity Operations Engineer is responsible for the programmatic design, automation, and architectural integrity of Hydro Ottawa's cybersecurity infrastructure. Working within the Cybersecurity team to protect the organization's critical infrastructure and assets, this role leverages an engineering framework to design baseline system configurations, build automated integration pipelines, and orchestrate workflows to proactively prevent, detect, and manage cyber threats across corporate applications, identity systems, and infrastructure platforms.

Under the guidance of the Supervisor, Cybersecurity, the Cybersecurity Operations Engineer acts as the primary technical asset for cybersecurity systems architecture, incident response, automation activities, authentication policies, enterprise application interfacing, and day-to-day user support operations. The Cybersecurity Operations Engineer is responsible for evaluating, scripting, and supporting the development of all new system integrations, ticketing workflows, and related business processes to ensure advanced security controls, compliance baselines, and identity architectures are strictly incorporated across the corporate environment.

Additionally, the role serves as a core technical resource for confidential internal security investigations, regularly isolating and preserving digital forensic evidence relating to employee policy violations, data exfiltration, or labour relations breaches.

MAJOR RESPONSIBILITIES

• Programmatically orchestrate, analyze and respond to security alerts by designing, identifying root causes and contributing factors, testing, and engineering automated playbooks to continuously harden infrastructure against future events and eliminate manual workflows.
• Conduct confidential internal security investigations into potential policy violations, unauthorized access, and data exfiltration by personnel.
• Regularly collect, analyze, and preserve digital forensic evidence required by Management for employee disciplinary actions, grievances, or formal labour relations proceedings.
• Monitor internal employee system logs and network activities on a confidential basis to identify and report scrutiny irregularities or compliance breaches directly to Management.
• Proactively monitor and analyze actionable threat intelligence from industry feeds and open-source intelligence (OSINT) to programmatically update detection rules, SIEM watchlists, and automated playbooks against emerging cyber threats.
• Conduct exposure management across corporate systems to detect vulnerabilities, prioritize risk mitigation efforts, and guide other IT teams on architectural remediation.
• Ensure strict alignment with corporate security frameworks through continuous validation of compliance baselines across internal endpoints, host infrastructure, and directory access permissions.
• Address, respond to, and resolve incoming tickets within the corporate ticketing system, serving as a primary point of contact for security operations.
• Provide advanced technical support and engineering guidance to internal units, resolving complex authentication blocks, systemic vulnerabilities, and integration constraints.
• Act as the engineering liaison to the CSaaS Security Operations Center (SOC) to investigate security detections, manage data sources, and troubleshoot device connectivity.
• Engineer, maintain, and secure core network trust infrastructure, by deploying automated solutions to manage trust certificates for internal resources (e.g., workstations, servers, websites).
• Develop, write, and maintain custom scripts (e.g., PowerShell, Python, Bash) to automate repetitive security tasks, streamline log analysis, and optimize operational pipelines.
• Architect, test, and implement secure integrations between new software applications, cloud environments, and existing core IT infrastruct