Security Specialist - Intermediate

- Pay Rate: Flexible- Hybrid
- Location: Toronto, Ontario
- Contract Length: 8 Months

We at Raise are hiring right now for one of our Clients. If you’re interested, apply below for your chance to join a great place to work.

Responsibilities:

a. CTEM & Exposure Management:

- Operate and Mature Day‑to‑Day CTEM Activities: Execute continuous, day‑to‑day threat and exposure analysis as part of regular CTEM operations. This includes daily review and analysis of attack surface risk using Microsoft Defender, Tenable, Prisma Cloud, and native Azure and AWS security services, to identify vulnerabilities, misconfigurations, identity risks, and externally exposed assets requiring immediate attention.
- Perform day-to-day threat analysis leveraging multiple threat intelligence sources, vulnerability disclosures, emerging cyber threat trends, and security advisories to assess organizational impact and drive risk-based response and remediation activities.
- Risk-Based Prioritization & Remediation: Implement mechanisms to assess and score exposures based on exploitability, potential impact, and relevant threat intelligence. Develop risk-based remediation plans and work with IT and application teams to ensure that critical exposures are remediated promptly. Provide clear communication of risk rankings and recommended actions to stakeholders.

b. DevSecOps & Cloud Security Operations:

- DevSecOps Pipeline Integration: Collaborate with software development and DevOps teams to embed security testing into the CI/CD pipelines. Implement and tune SAST, DAST, SCA, and Infrastructure-as-Code scanning tools so that code, dependencies,



and cloud templates are scanned for vulnerabilities with each build/release. Ensure that these processes are automated and produce actionable results for developers, with minimal false positives.
- Secure Coding & Remediation Support: Provide guidance and best practices to development teams on resolving vulnerabilities identified through pipeline scans.
- Cloud Security Posture Management: Take ownership of monitoring and improving the security posture of OH’s AWS and Azure environments. Regularly review cloud configurations and identify misconfigurations or compliance gaps (e.g., open storage buckets, overly permissive roles, unpatched workloads). Configure and operate a CSPM/CNAPP tool to continuously detect, categorize, and report such issues.
- Cloud Risk Remediation & Integration: Work with cloud engineering and operations teams to remediate identified cloud risks

Desired Skills:

- Experience in healthcare or public sector environments, particularly Ontario health sector
- Prior exposure to or participation in threat intelligence and threat hunting activities.
- Knowledge of up-to-date containerization and cloud-native application development practices, including Kubernetes security and microservices architecture, as a plus.
- Relevant certifications (e.g., CISSP, CISM, GIAC, Azure Security Engineer)

Required Skills:

- Minimum 5–8 years of experience in cyber security,



with extensive exposure to security operations and vulnerability management or devSecOps programs
- Proven experience developing and executing a continuous threat exposure management or advanced vulnerability management program (e.g., CTEM), including continuous discovery of exposures, threat scenario analysis, attack-path mapping, and risk-based prioritization of remediation actions.
- Deep DevSecOps experience, with hands‑on implementation of secure CI/CD pipeline practices (integrating SAST, DAST, SCA, IaC security scanning, container security scans) in collaboration with development/DevOps teams.
- Strong cloud security expertise across AWS and Azure, including practical knowledge of cloud-native security controls (IAM, network security groups, logging/monitoring, encryption) and cloud threat detection services (e.g., AWS GuardDuty, Azure Defender/Sentinel).
- In-depth experience operating a Cloud Security Posture Management (CSPM) or CNAPP solution (e.g., Prisma Cloud or similar) to continually assess and improve cloud posture.
- Excellent written and verbal communication skills, with the ability to produce clear technical documentation, reports, and executive-level summaries.

Strong expertise in:

- Continuous Threat Exposure Management and Vulnerability Management: Hands-on experience running programs that continuously identify and mitigate security exposures, aligning closely with organizational risk tolerance.
- DevSecOps and Secure SDLC: Proven ability to implement and manage security controls within CI/CD pipelines, and to work with DevOps tools and processes (source control, CI servers, container

📌 Security Specialist (Toronto)
🏢 Ian Martin Group
📍 Toronto