Cybersecurity contract work in Calgary and Alberta is shaped by energy. Oil and gas producers, pipeline operators and electricity companies need operational technology (OT) security, compliance with Alberta's critical infrastructure protection standards for the grid, and security programme work for large IT estates. Alongside them, a growing technology sector needs SOC 2 and testing, and public bodies have new privacy duties under Alberta's 2025 public sector privacy law. Here is how that work reaches contractors.
Energy and OT security
Calgary is the head office city for much of Canada's energy industry, and energy companies run industrial control systems that look nothing like a corporate network: SCADA, distributed control systems, safety systems and field devices with long lifespans. Securing them is a specialist practice, and much of it is contracted out because the work is project-based: an OT network assessment, a segmentation project, a vendor remote access review, an incident response plan for a plant.
The standards that come up most in this work include:
- IEC 62443. The international series of standards for industrial automation and control system security, widely used for OT programmes and vendor requirements.
- CSA Z246.1. The CSA Group standard on security management for petroleum and natural gas industry systems.
- NIST guidance on OT security, often used alongside the above for control design.
OT security rewards people who understand both security and how industrial processes work. A tester who scans a control network carelessly can stop a process, so clients look for contractors who have worked in plants or with control systems vendors, and who know when not to touch something.
Electricity: Alberta Reliability Standards and CIP
Alberta's electricity system has its own regime. The Alberta Electric System Operator (AESO) adopts Alberta versions of the NERC Critical Infrastructure Protection (CIP) standards as Alberta Reliability Standards, and it has been aligning them with the latest NERC versions, including the supply chain risk management standard CIP-013. Generation and transmission companies subject to these standards need compliance programmes, evidence, internal reviews and audit preparation, and many bring in contractors with CIP experience to do it. This is GRC work with a very specific vocabulary, and practitioners who know it are hard to replace.
Alberta privacy law
PIPA: private organizations
Alberta's Personal Information Protection Act applies to private-sector organizations in the province, in place of PIPEDA for activity within Alberta, while PIPEDA still applies to federally regulated businesses and cross-border transfers. Alberta PIPA includes mandatory breach notification to the Commissioner where there is a real risk of significant harm.
POPA: public bodies
On June 11, 2025, the Protection of Privacy Act (POPA) and the Access to Information Act replaced Alberta's FOIP Act for public bodies. POPA requires public bodies to establish a privacy management programme, with a deadline a year after the new acts came into force, and it raised the penalties for offences. Provincial ministries, municipalities, school boards and post-secondary institutions have needed help with programme design, privacy impact assessments and policies, and that work continues as programmes mature.
Health information
The Health Information Act governs health information in Alberta's health system, and health technology vendors and custodians need privacy and security work under it.
Our guide to independent privacy consulting in Canada covers the work itself.
Calgary's technology sector
Calgary also has a growing technology sector, including energy technology, fintech and SaaS companies. They need what technology companies everywhere need: SOC 2 readiness to sell to larger customers, penetration testing, cloud security reviews and fractional security leadership. Our national guides to contract SOC 2 and ISO 27001 consulting work and contract penetration testing work cover those practices.
How contract work reaches people in Alberta
- IT and engineering staffing agencies. Energy companies fill a lot of security roles through agencies on hourly contracts, often for the length of a project.
- Engineering and OT consultancies. Firms that design and integrate control systems also sell OT security, and subcontract specialists.
- Security consultancies that subcontract readiness, testing and privacy work to vetted independents.
- Former colleagues. Alberta's energy industry is tightly connected, and people who have worked together at one operator move to the next.
Our list of cybersecurity job boards in Canada for contract work covers the agencies and boards that carry Alberta contracts.
Alberta security communities
- BSides Calgary. A volunteer-run, not-for-profit community security conference held each year in Calgary.
- BSides Edmonton. The equivalent event in the provincial capital, close to the public sector.
- ISACA Calgary Chapter. Events for audit, risk and governance practitioners, including many in energy.
Practical points for contracting in Alberta energy
- Site access. Work at plants and field sites usually comes with safety orientation and site rules, and sometimes travel to remote locations. Ask about both before you price or schedule the work.
- Change windows. Control systems are changed and tested in planned windows, often tied to maintenance shutdowns. Assessments that touch live systems need operations sign-off and a rollback plan.
- Vendor involvement. Control system vendors often have to be part of any change, and their support terms can limit what you are allowed to test.
- Confidentiality. Network diagrams and asset lists for energy infrastructure are sensitive. Keep them in the client's systems, not on personal devices, and expect strict NDAs.
Contractors who plan around these constraints, rather than discovering them in week two, are the ones asked back.
Senior and analyst routes in Alberta
Senior practitioners with OT or CIP experience are the scarcest people in this market, and lead assessments, programme design and audit preparation. Senior IT security leaders can work as fractional CISOs for mid-sized energy and technology companies, as covered in our post on becoming a fractional CISO in Canada. Analysts with three or more years can take CIP evidence and compliance work, OT asset inventories, vendor access reviews, POPA programme documentation and SOC 2 evidence, ideally under a lead who reviews the work. Our guide to contract GRC analyst work describes those tasks.
Where the TrazTech Associate Network fits
We run the TrazTech Associate Network, so weigh this accordingly. It does not have an OT practice, so it is not the place for control system work. It may suit Alberta practitioners in compliance readiness, offensive security on IT systems, cloud, security leadership and vCISO, privacy, AI governance or internal audit, plus engagement coordinator and report QA roles. You need at least three years of relevant experience, at least five hours a week, and employment that allows side work. The assessment is a realistic simulated client engagement of about three hours with 72 hours to submit, then a 30-minute call, an identity check and a background declaration. Work comes as fixed-scope work orders with the scope and fee shown before you accept, and you can decline without penalty. Work follows client demand in your practice. You can apply here.
Frequently asked questions about cybersecurity contract work in Calgary and Alberta
Is OT security experience needed for cybersecurity work in Calgary?
Not for all of it. Corporate IT security, privacy and technology sector work do not need it. OT experience opens the energy-specific work, which is a large part of the market.
What are CIP standards in Alberta?
Alberta Reliability Standards include Alberta versions of the NERC Critical Infrastructure Protection standards, adopted by the AESO, which apply to entities in the electricity system.
What replaced the FOIP Act in Alberta?
The Protection of Privacy Act and the Access to Information Act, both in force since June 11, 2025.
Does Alberta PIPA or PIPEDA apply to Calgary companies?
Alberta PIPA applies to private organizations' handling of personal information within Alberta. PIPEDA applies to federally regulated businesses and cross-border transfers.
Which Alberta security events are worth attending?
BSides Calgary and BSides Edmonton, and ISACA Calgary Chapter events for governance and audit practitioners.
Take scoped security work as an independent associate. The TrazTech Associate Network offers fixed-scope compliance, privacy, testing and cloud work orders to vetted practitioners. You see the scope and fee first, and you can decline any offer.
About the Associate NetworkOr apply now