Job Title: RQ00816 - Security Specialist - Intermediate Location: Toronto ON , Hybrid Pay Rate: 55-63/hr Description Background Information The purpose of this request is to procure a contingent cyber security resource in a Security Specialist – Intermediate capacity to support the Cyber Security Defence Operations team with hands-on operational initiatives for Ontario Health (OH).

This role is explicitly hands-on and operational, requiring the resource to collaborate across teams (SOC, Dev

Ops, cloud engineering) to implement and execute solutions rather than just providing recommendations.

The role focuses on two primary areas: • Continuous Threat Exposure Management (CTEM): Leading the design, operationalization, and execution of a CTEM program.

This involves threat exposure and attack path analysis, validation of exploitability, and risk-based prioritization.

The resource will strengthen workflows between CTEM, SOC, and vulnerability management, using Security Copilot and security automation agents for AI-assisted analysis and data correlation. • Dev

SecOps Pipeline Security & Cloud Security Posture Management (CSPM): Embedding security into the software development lifecycle (SDLC) and CI/CD pipelines.

This includes integrating automated security testing tools (SAST, DAST, SCA, container/IaC scanning) to achieve a "shift-left" approach.

In parallel, the resource will oversee CSPM and Cloud-Native Application Protection Platform (CNAPP) operations across OH’s AWS and Azure environments to identify misconfigurations, runtime threats, and reduce overall cloud risk.

Responsibilities CTEM & Exposure Management • Day-to-Day Operations: Execute continuous threat, exposure, and attack surface risk analysis.

Daily review and monitor vulnerabilities, misconfigurations, identity risks, and externally exposed assets using Microsoft Defender, Tenable,



Prisma Cloud, and native Azure/AWS security services. • Threat Intelligence Integration: Analyze daily threat intelligence feeds, vulnerability disclosures, and emerging cyber threat trends to assess organizational impact and drive risk-based response activities. • Prioritization & Remediation: Evaluate and score exposures based on exploitability, impact, and threat intelligence.

Develop risk-based remediation plans and collaborate with IT and application teams to ensure critical issues are addressed promptly.

Dev

SecOps & Cloud Security Operations • CI/CD Pipeline Integration: Collaborate with Dev

Ops teams to automate, tune, and embed SAST, DAST, SCA, and Infrastructure-as-Code (IaC) security scanning into build/release workflows, minimizing false positives. • Secure Coding Support: Provide technical guidance and best practices to development teams to help remediate vulnerabilities found during pipeline scans. • Cloud Posture Management: Configure and operate CSPM/CNAPP tools to continuously monitor the security posture of AWS and Azure environments.

Identify and categorize risks such as open storage buckets, overly permissive roles, or unpatched workloads. • Risk Remediation: Partner directly with cloud engineering and operations teams to execute fixes for identified cloud risks.

Required Skills & Experience • Experience: 5–8 years of experience in cyber security, with a strong background in security operations,



vulnerability management, or Dev

SecOps programs. • CTEM Program Execution: Proven experience running a continuous threat exposure management or advanced vulnerability management program, including exposure discovery, threat scenario analysis, attack-path mapping, and risk-based prioritization. • Dev

SecOps Engineering: Deep hands-on experience integrating security testing tools (SAST, DAST, SCA, IaC, container scanning) into automated CI/CD pipelines and source control workflows. • Multi-Cloud Security: In-depth hands-on knowledge of securing AWS and Azure environments, including identity management (IAM), network security controls, monitoring/logging (Cloud

Trail, Cloud

Watch, Azure Monitor), and threat detection services (Guard

Duty, Azure Defender/Sentinel). • CSPM/CNAPP Operations: Practical experience operating, configuring, and tuning cloud posture platforms (e.g., Prisma Cloud or similar) to match organizational risk tolerance. • Communication & Teamwork: Strong verbal and written communication skills.

Demonstrated ability to break down silos, collaborate across multi-disciplinary technical teams, and translate complex security data into clear technical documentation or executive summaries.

Desired Skills • Healthcare/Public Sector: Prior experience working within healthcare or public sector environments, particularly within the Ontario health sector. • Defense Operations: Direct exposure to or participation in proactive threat intelligence and threat hunting activities. • Cloud-Native Architecture: Knowledge of modern containerization and cloud-native practices, including Kubernetes security and microservices architecture. • Qualified Certifications: Relevant certifications such as CISSP, CISM, GIAC, or Azure Security Engineer.

📌 Security Specialist - Intermediate I Ontario Health I Hybrid (Toronto)
🏢 Analyst Technical Solutions
📍 Toronto