RQ00816 - Security Specialist - Intermediate

This role will focus on two primary areas:

Continuous Threat Exposure Management (CTEM) : Leading thedesign and operationalization of a CTEM program that provides continuousvisibility into the organization’s cyber exposure. This includes threatexposure analysis, attack path analysis, validation of remediation throughtesting, and risk-based prioritization to ensure critical issues are addressedfirst.. The resource will strengthen coordination between CTEM, SOC, andvulnerability management workflows, ensuring that exposure findings translateinto actionable improvements in monitoring, detection, and response.

Demonstrated hands-on experience using Security Copilot andsecurity automation agents to support CTEM execution, including AI-assistedthreat analysis, correlation of exposure data, attack‑path analysis, andvalidation of exploitability

DevSecOps Pipeline Security & Cloud Security PostureManagement: Implementing and enhancing DevSecOps practices by embeddingsecurity into the software development lifecycle (SDLC) and CI/CD pipelines.The resource will lead the integration of security testing tools (SAST, DAST,SCA, container/IaC scanning) into automated build processes, ensuringvulnerabilities are identified and addressed as early as possible (“shift-left”approach). In parallel, the role will oversee cloud security posture management(CSPM) and cloud-native application protection platform (CNAPP) operationsacross OH’s AWS and Azure environments, to continuously monitor and remediatecloud security risks. This involves implementing a CSPM/CNAPP solution toidentify misconfigurations, insecure practices, and runtime threats, andworking with cloud teams to reduce risk.





This role is explicitly hands-on and operational. Itrequires a robust technical background in cyber defense operations and theability to execute and deliver tangible outcomes in the areas above. Theresource will be expected to work across teams (SOC, DevOps, cloud engineering,etc.) to implement and execute, rather than only providing recommendations.

Responsibilities:

a. CTEM & Exposure Management:

- Operateand Mature Day‑to‑Day CTEM Activities: Execute continuous, day‑to‑daythreat and exposure analysis as part of regular CTEM operations. Thisincludes daily review and analysis of attack surface risk using MicrosoftDefender, Tenable, Prisma Cloud, and native Azure and AWS securityservices, to identify vulnerabilities, misconfigurations, identity risks,and externally exposed assets requiring immediate attention.

- Performday-to-day threat analysis leveraging multiple threat intelligencesources, vulnerability disclosures, emerging cyber threat trends, andsecurity advisories to assess organizational impact and drive risk-basedresponse and remediation activities.

- Risk-BasedPrioritization & Remediation: Implement mechanisms to assess and scoreexposures based on exploitability, potential impact, and relevant threatintelligence. Develop risk-based remediation plans and work with IT andapplication teams to ensure that critical exposures are remediatedpromptly.



Provide clear communication of risk rankings and recommendedactions to stakeholders.

b. DevSecOps & Cloud Security Operations:

- DevSecOpsPipeline Integration: Collaborate with software development and DevOpsteams to embed security testing into the CI/CD pipelines. Implement andtune SAST, DAST, SCA, and Infrastructure-as-Code scanning tools so thatcode, dependencies, and cloud templates are scanned for vulnerabilitieswith each build/release. Ensure that these processes are automated andproduce actionable results for developers, with minimal false positives.

- SecureCoding & Remediation Support: Provide guidance and best practices todevelopment teams on resolving vulnerabilities identified through pipelinescans.

- CloudSecurity Posture Management: Take ownership of monitoring and improvingthe security posture of OH’s AWS and Azure environments. Regularly reviewcloud configurations and identify misconfigurations or compliance gaps(e.g., open storage buckets, overly permissive roles, unpatchedworkloads). Configure and operate a CSPM/CNAPP tool to continuouslydetect, categorize, and report such issues.

- CloudRisk Remediation & Integration: Work with cloud engineering andoperations teams to remediate identified cloud risks

Desired Skills:

- Experience in healthcare or public sector environments,particularly Ontario health sector

- Prior exposure to or participation in threat intelligenceand threat hunting activities.

- Knowledge of modern containerization and cloud-nativeapplication development practices, including Kubernetes security andmicroservices architecture, as a plus.

- Relevant certifications (e.g., CISSP, CISM, GIAC, AzureSecurity Eng

📌 11771 (Toronto)
🏢 Maarut
📍 Toronto