87610# Cloud Computing Specialist (Cybersecurity Advisor)MontrealHybridCybersecurity and Identity ManagementApplyWith over 30 years of recognized expertise, COFOMO is now a leading Canadian consulting firm specializing in digital and artificial intelligence. Supported by more than 3,000 experts, 10 Centers of Excellence, and 4 offices across the country, we are uniquely positioned to successfully guide our clients through their transformations. Both strategic and tactical, we help organizations across a wide range of industries thrive in today’s rapidly evolving world.## Our promiseHelp our clients succeed and maximize the impact of their transformation initiatives, turning them into powerful drivers of growth and innovation.## Job description**Here's a brief overview of the tasks and responsibilities you'll have :** • Provide cloud security expertise during solution design, architecture reviews, project delivery, and technology change initiatives; • Evaluate cloud architectures and services based on security requirements, approved models, and risk appetite; • Recommend appropriate security controls for identity and access management, networking, data protection, encryption, key and secret management, logging, monitoring, backups, and resiliency; • Support threat modeling and cloud risk assessments by translating identified risks into accurate and enforceable security controls; • Document security recommendations and decisions, residual risks, exceptions, and required corrective actions; • Promote security-by-design and least privilege principles for cloud solutions and services; • Contribute to the implementation and continuous improvement of cloud security posture management and workload protection capabilities; • Review cloud configurations, security findings, proofs of control, and deviations from approved baselines; • Validate the effectiveness of preventive, detective, and remedial controls and identify misconfigurations, excessive permissions, exposed services, and inadequate security settings; • Work with environment owners to prioritize corrective actions based on risk exposure, operability, business impact, root causes, and compensating controls; • Develop and maintain relevant metrics on cloud security posture, control coverage, exceptions, and remediation progress; • Assess identity and access management controls, including privileged access, service and workload identities, role assignments, and segregation of duties; • Advise teams on secure authentication, authorization, conditional access,



federation and privileged access management mechanisms; • Support requirements for data classification and protection, encryption, key and certificate lifecycle, protection of secrets, and secure data retention and transfer; • Review network segmentation, connectivity, inbound and outbound flow controls, resource exposure to unauthorized external networks, and secure administrative access mechanisms; • Guide teams on securing virtual machines, managed services, databases, storage, serverless services, containers, Kubernetes, and integration platforms; • Integrate security requirements into Infrastructure as Code (IaC) practices and continuous integration and continuous deployment (CI/CD) pipelines, in collaboration with relevant teams; • Automate the validation of configurations, policies, and secrets to detect security deviations before deployment; • Contribute to the implementation of repeatable safeguards, Policy as Code controls, secure templates, and security controls built into deployment processes; • Analyze findings from infrastructure and vulnerability analysis tools, cloud security services, and code security tools; • Reduce reliance on manual controls and configuration creep through automated, repeatable security practices; • Verify security controls for containerized and Kubernetes workloads, including node access, identities, group and namespace isolation, network policies, image integrity, secrets, admission controls, and runtime protection; • Define and maintain secure baselines for containers, registries, platforms, and cloud workloads; • Lead vulnerability management and remediation of managed platform workloads, images, hosts, and components; • Define cloud security logging, alerting, monitoring, and telemetry requirements; • Improve detection coverage and operational efficiency of security alerts in collaboration with relevant stakeholders; • Participate in vulnerability assessments, investigations, and incidents by validating findings, assessing their severity, analyzing root causes,



and recommending corrective controls; • Integrate lessons learned from findings and incidents into standards, baselines, guardrails, and future solution reviews; • Support risk and control assessments, audits, and evidence reviews of compliance in cloud security; • Interpret security policies, standards, frameworks and regulatory requirements in the context of cloud services and delivery models; • Contribute to the development and maintenance of standards, guidelines, control objectives and reference models in cloud security; • Review waiver and exception requests, document risks and compensating controls, and follow up on remediation commitments; • Clearly communicate security risks and recommendations to technical stakeholders, risk managers, and management. **The profile we are looking for is as follows:** • Have at least 10 years of hands-on experience in information security, with a specialization in cloud security, cloud architecture, or cloud operations; • Have an excellent knowledge of the architecture and security of Microsoft Azure and Amazon Web Services (AWS); • Knowledge of Google Cloud Platform (GCP) security (an asset); • Master cloud identity and access management (IAM), privileged access management, networking, data protection, encryption, key and secret management, and logging, monitoring, and resiliency; • Experience evaluating cloud-native services, hybrid environments, containers, Kubernetes, and platform services; • Understand security concepts related to Infrastructure as Code (IaC) and the Shift Left approach in CI/CD pipelines, including Terraform, CloudFormation, Policy as Code, security controls, and automated configuration validation; • Demonstrate experience with Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), vulnerability management, secure configuration assessment, and remediation follow-up solutions; • Possess a valuable knowledge of security architecture, security controls, threat modeling, risk assessment, and secure design patterns; • Knowledge of recognized practices and frameworks, including CIS Benchmarks, NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-190, CSA Cloud Controls Matrix, and OWASP recommendations; • Demonstrate the ability to analyze security findings, distinguish significant risks from low-value items or false positives, and recommend controls commensurate with the level of risk; • Have a working knowledge of scripting or query languages used for security log analysis and automation (an asset).Apply
#J-18808-Ljbffr

📌 Cloud Computing Specialist (Cybersecurity Advisor) (Montreal)
🏢 COFOMO
📍 Montreal