Job Title: Security Specialist - Intermediate

Duration: 8 months (Nov 29, 2026 to Aug 9, 2027)

Must Haves

- Minimum 5 8 years of experience in cyber security, with extensive exposure to security operations and vulnerability management or devSecOps programs
- Proven experience developing and executing a continuous threat exposure management or advanced vulnerability management program (e.g., CTEM), including continuous discovery of exposures, threat scenario analysis, attack-path mapping, and risk-based prioritization of remediation actions.
- Deep DevSecOps experience, with hands-on implementation of secure CI/CD pipeline practices (integrating SAST, DAST, SCA, IaC security scanning, container security scans) in collaboration with development/DevOps teams.
- Strong cloud security expertise across AWS and Azure, including practical knowledge of cloud-native security controls (IAM, network security groups, logging/monitoring, encryption) and cloud threat detection services (e.g., AWS GuardDuty, Azure Defender/Sentinel).
- In-depth experience operating a Cloud Security Posture Management (CSPM) or CNAPP solution (e.g., Prisma Cloud or similar) to continually assess and improve cloud posture.
- Excellent written and verbal communication skills, with the ability to produce clear technical documentation, reports, and executive-level summaries.
- Continuous Threat Exposure Management and Vulnerability Management: Hands-on experience running programs that continuously identify and mitigate security exposures, aligning closely with organizational risk tolerance.
- DevSecOps and Secure SDLC: Proven ability to implement and manage security controls within CI/CD pipelines, and to work with DevOps tools and processes (source control, CI servers, container platforms, etc.) to improve software security.
- Cloud Security (AWS & Azure): In-depth hands-on knowledge of securing cloud environments, including identity management, network security, monitoring (CloudTrail, CloudWatch, Azure Monitor), and secure configuration of cloud services.
- CSPM/CNAPP Solutions: Operational experience with cloud security posture management platforms, and the ability to configure and tune these tools to an organization's environment and policies.
- Demonstrated experience establishing or significantly contributing to a CTEM or continuous vulnerability management program.
- Hands-on experience integrating security into CI/CD pipelines (implementing SAST, DAST, container security, etc.).
- Strong experience with AWS and Azure security controls and best practices.




- Proven operation of a CSPM or CNAPP platform (e.g., configuring rules, analyzing findings, managing remediation workflows).

Description / Responsibilities / Skills

Description

- This role is explicitly hands-on and operational.
- The resource will be expected to work across teams (SOC, DevOps, cloud engineering, etc.) to implement and execute, rather than only providing recommendations.

a. CTEM & Exposure Management:

- Perform day-to-day threat analysis leveraging multiple threat intelligence sources, vulnerability disclosures, emerging cyber threat trends, and security advisories to assess organizational impact and drive risk-based response and remediation activities.

b. DevSecOps & Cloud Security Operations:

- Secure Coding & Remediation Support: Provide guidance and best practices to development teams on resolving vulnerabilities identified through pipeline scans.
- Cloud Risk Remediation & Integration: Work with cloud engineering and operations teams to remediate identified cloud risks

Deliverables

- DevSecOps Findings & Metrics: Deliver periodic summaries of vulnerabilities detected in pipelines, highlighting trends (e.g., common weakness types in code or configurations) and improvements over time as DevSecOps practices mature.
- Secure Development Standards & Training Materials: Develop or update secure coding and DevSecOps best-practice documents tailored to OH's development setting.
- Cloud Security Assessment & Gap Analysis: Conduct an initial end-to-end cloud security posture assessment of OH's AWS and Azure environments.
- CSPM/CNAPP Implementation: Fully deploy and configure the CSPM/CNAPP platform for multi-cloud coverage.

Experience & Skill Set Requirements

Demonstrated ability to

- Design and implement complex security solutions and processes, ensuring they are effectively integrated into everyday operations (e.g., implementing CTEM processes and ensuring follow-through; integrating new security tools so they are used consistently by teams).
- Perform risk-based analysis and prioritization, evaluating where to focus security resources for maximum impact and articulating the rationale to stakeholders.




- Collaborate across multidisciplinary teams (security, IT, DevOps, cloud, business) to drive security initiatives, overcoming silos and aligning efforts with organizational objectives.
- Communicate complex security issues and solutions clearly, adjusting the level of detail for technical teams versus leadership or non-technical stakeholders.

Solid understanding of

- Modern cyber threat landscape and attack vectors
- Security architecture principles in both on-premises and cloud environments

Core competencies

- Strong focus on execution, delivery, and measurable outcomes
- Strong analytical and problem-solving skills, enabling the resource to dissect complex security problems, identify root causes, and develop creative solutions.
- Execution and delivery focus, demonstrating a bias toward action and results setting clear goals, meeting deadlines, and delivering high-quality outputs that measurably improve security posture.
- Adaptability and continuous learning, staying current with emerging threats, new security technologies, and best practices, and quickly adjusting approaches as the environment evolves.
- Teamwork and mentorship, working well within team settings, sharing knowledge, and helping to upskill internal team members throughout the engagement.

Required Experience: 2.DevSecOps & Application Security Experience

- Experience collaborating with development/DevOps teams to remediate security issues and improve secure coding practices.
- Familiarity with infrastructure-as-code (IaC) and managing security in containerized or cloud-native application environments.

Required Experience: 3.Cloud Security & CSPM Operations

- Ability to align cloud security initiatives with overall security program and compliance requirements.

Desired Skills

- Experience in healthcare or public sector environments, particularly Ontario health sector
- Prior exposure to or participation in threat intelligence and threat hunting activities.
- Knowledge of modern containerization and cloud-native application development practices, including Kubernetes security and microservices architecture, as a plus.
- Relevant certifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer)

Project Description / Background (AI requirement)

- Demonstrated hands-on experience using Security Copilot and security automation agents to support CTEM execution, including AI-assisted threat analysis, correlation of exposure data, attack path analysis, and validation of exploitability

📌 Security Specialist - Intermediate (Toronto)
🏢 Innosystech
📍 Toronto