System Architect - Krembil Centre for Neuroinformatics

The Integrated Youth Services (IYS) data platform is a federated, bilingual, pan-Canadian learning health system that brings together integrated youth services networks and hubs across the country to transform mental health and substance use care for young people. The platform enables cross-network utilization reporting, population needs assessment, program evaluation, and service infrastructure analysis — all while ensuring that each partner network retains ownership and control of its own data. Delivered through the Krembil Centre for Neuroinformatics (KCNI) at CAMH, the initiative emphasizes open, reproducible, data-driven research, strong data governance, and global collaboration.

Reporting to the KCNI Operations Manager, the full-time, contract (12 months) Solution Architect leads the cloud and solution architecture for the IYS data platform. Built on Google Cloud Platform (GCP) and designed around partner data sovereignty, the platform requires an architect to own the end-to-end design, integrity, and evolution of the GCP environment and its integration with CAMH's broader on-premises and cloud infrastructure.

Working in close partnership with the platform's Data Architect, the Solution Architect owns the technology and infrastructure architecture — GCP organization and landing-zone design, the multi-tenant folder-per-partner model, identity federation, networking, security perimeters, and the container and AI-serving substrate — while the Data Architect leads the data models, governance, and semantic layers. The role translates research and program objectives into scalable, secure, and portable solutions; produces architectural diagrams and decision records; and leads stakeholder engagement across IYS network partners, CAMH IT and Information Management Group (IMG) teams, and vendors.

Portability and open standards (e.g., containerized workloads on GKE and infrastructure-as-code) are a central design principle, keeping the platform free of vendor lock-in.

Because CAMH operates a hybrid estate — Microsoft Azure and Entra ID underpin identity and enterprise services, and the on-premise footprint is expanding with the organization's move to a new building — the Solution Architect must pair cloud expertise with a strong working understanding of on-premise infrastructure. The role designs the connective tissue between environments: hybrid connectivity, Entra ID-to-GCP identity federation, and consistent security, logging, and monitoring across cloud and data-centre boundaries — ensuring IYS solutions interoperate cleanly with CAMH's on-premise and Azure-based services while meeting the privacy and security requirements appropriate to sensitive health data.

Lead the design and evolution of the IYS platform's cloud and solution architecture on GCP, aligning it with research and program objectives and requirements for scalability, security, and partner data sovereignty; produce architectural diagrams, decision records, and specifications to communicate the design to stakeholders and partners.

• Own the GCP organization and landing-zone architecture — the multi-tenant folder-per-partner model, non-production/production isolation, organization policies, and the resource hierarchy — enabling governance inheritance and clear separation of responsibilities across IYS networks, the collaboration layer, and shared infrastructure.
• Define the platform's networking, security, and identity architecture, including hybrid connectivity to on-premises/partner environments (e.g., HA-VPN, dynamic routing, private service connectivity), VPC design, security perimeters, and centralized logging and monitoring integrated with CAMH security tooling.
• Design and maintain Entra ID-to-GCP identity federation — single sign-on, SCIM group provisioning, and workload identity — so access is centrally managed and consistent across cloud and enterprise environments.
• Partner with the Data Architect so the technology architecture cleanly supports the data models, governance, and semantic layers, maintaining a clear, documented boundary between solution and data architecture.
• Lead the architecture of the container and AI-serving substrate (e.g., GKE, infrastructure-as-code, vendor-neutral interfaces), upholding portability and open-standards principles to avoid vendor lock-in.
• Define system components, interfaces, and dependencies for performance, security, reliability, and scalability; conduct architectural reviews, benchmarking, and capacity and resilience planning.
• Define integration and interoperability strategies for connecting platform components with third-party services, APIs, partner systems, and CAMH's on-premises and Azure-based services.
• Architect the integration between the IYS platform and CAMH's expanding on-premises footprint tied to the relocation, ensuring clean interoperability across on-premises and cloud boundaries to enterprise infrastructure and security standards.
• Evaluate technologies, frameworks, and platforms, and review new and existing cloud designs for best-practice alignment and compliance with CAMH IT and security standards.
• Lead and co-lead stakeholder engagement across IYS network partners, CAMH IT and IMG teams, developers, project managers, and vendors, building and maintaining strong working relationships through a collaborative approach to ensure seamless solution delivery.
• Define standards and guardrails for infrastructure-as-code, DevOps pipelines, and the SDLC so deployments are consistent, repeatable, and auditable across partners.
• Ensure the architecture meets the privacy, security, and compliance requirements appropriate to sensitive health data in a multi-partner research environment.
• Other duties as assigned.
• Bachelor's degree (or equivalent) preferably in a computer-related field
• 5+ years of senior-level experience in solution, cloud, or systems architecture for medium/large enterprise or data platforms
• Demonstrated expertise architecting on Google Cloud Platform (e.g., organization and landing-zone design, IAM, BigQuery, GKE, networking, security perimeters)
• Experience designing hybrid architectures that integrate cloud platforms with on-premises infrastructure, including hybrid connectivity, routing, DNS, and private connectivity
• Experience with Microsoft Azure and Entra ID, including identity federation, single sign-on, and SCIM provisioning
• Strong understanding of infrastructure-as-code (e.g., Terraform), containerization and orchestration (e.g., Kubernetes/GKE), and CI/CD and DevOps practices
• Solid understanding of networking and core protocols (e.g., TCP/IP, DNS, VPN, BGP) and of security architecture, logging, and monitoring
• Strong verbal, presentation, and written communication skills, with an ability to express complex technical concepts in business terms
• Superior interpersonal skills and the ability to work well on cross-functional project teams, understand stakeholder needs, and foster productive working relationships

Preferred Qualifications

• Experience architecting multi-tenant or federated platforms with strong tenant isolation and data-sovereignty controls (e.g., VPC Service Controls or equivalent perimeter security)
• Working knowledge of Canadian health-data privacy and compliance (e.g., PHIPA, PIPEDA), data-residency requirements, and handling of PHI, ideally within a hospital, research institute, or other regulated environment
• Depth in cloud security architecture — security perimeters, KMS/secrets management, and SIEM/security operations (e.g., Google Security Command Center, Microsoft Sentinel); GCP Professional Cloud Security Engineer or CISSP an asset
• GCP Professional Cloud Architect, Azure, or related cloud certifications
• Experience architecting AI/ML or GPU-based workloads (e.g., containerized model serving, MLOps), relevant to the platform's GKE-based AI-serving layer
• Cloud cost management / FinOps experience, including optimizing GPU and compute spend across many projects or tenants
• Familiarity with a modern data and analytics stack (e.g., BigQuery, Looker, dbt, a metadata/catalog tool) sufficient to collaborate effectively with the Data Architect
• Experience with data and data systems used in the mental health and addictions sector, or a comparable health, research, or regulated data environment
• Awareness of Indigenous data sovereignty principles (e.g., OCAP, CARE) as they apply to pan-Canadian, multi-partner data governance
• Experience delivering across distributed or federated partner organizations, or in a public-sector, academic, or non-profit consortium context
• Bilingualism (French/English) and/or proficiency in another language

Salary Range: $49.21 – $66.61 per hour

CAMH is a fully affiliated teaching hospital and research institute of the University of Toronto. As a CAMH employee, you will contribute to our mission by supporting teaching, research, and clinical care across the hospital.

CAMH is dedicated to equity, diversity, and inclusion. Our commitment is to foster a workplace, teaching, and learning environment that is inclusive, respectful, and free from discrimination or harassment.

CAMH strongly encourages applications from candidates who reflect the diversity of the communities we serve, including First Nations, Métis, and Inuit Peoples; Black and other racialized communities; LGBTQ2S+ communities; women; and people with disabilities, including those with lived experience of mental health and substance use challenges.

We welcome applicants from all backgrounds. Thank you to all who apply; however, only those selected for an interview will be contacted. If you require accommodations during the application or recruitment process, please let us know.