Sr Secret cleared Business Analyst working on the Incident Management project updating the incident management framework, play book and other artifacts for

Our valued Public Sector client requires a Senior Secret cleared Business Analyst working on the Incident Management project updating the incident management framework, play book and other artifacts for a Cyber and IT security renewal program.

Must Have:

• Experience developing creating/updating incident management framework and playbook
• Experience with sentinel
• Canadian post-secondary degree/Diploma or equivalent
• Valid Secret Clearance

Tasks Include, but are not Limited to:

1. Review Existing IMF and IRP

• Understand the current structure, scope, and effectiveness of the existing IMF and IRP.
• Analyze the IMF and IRP documents for outdated procedures, unclear roles, or missing scenarios.
• Identify alignment with current regulatory requirements and industry standards

2. Collect Lessons Learned

• Gather insights from real incidents and exercises to inform improvements.
• Review post-incident reports for root causes, response effectiveness, and recovery timelines.
• Analyze simulation and tabletop exercise debriefs for procedural gaps or confusion.
• Interview key participants for qualitative feedback.

3. Draft IMF and IRP Updates

• Map lessons to specific IMF and IRP section
• Add new scenarios or threat vectors.
• Ensure alignment with business continuity and disaster recovery plans.

4. Conduct Stakeholder Review Sessions

• Identify internal (within Cyber and IT Security) and external stakeholders (within other divisions directorates and branches), including the client, project team, and end-users.
• Schedule review workshops or circulate the draft for feedback.

5. Incorporate Feedback and Finalize IMF and IRP

• Integrate feedback from all stakeholders.
• Perform a final quality check for clarity, consistency, and completeness.
• Produce a final, approved version of the IMF and IRP.

6. Obtain Executive Approval

7. Develop and Execute Communications Plan

8. Update existing and develop new Incident Response Playbooks