Security Specialist – Hybrid in Toronto

• Pay Rate:55-63/hr
• Description
• Background Information

The purpose of this request is to procure a contingent cyber security resource in a Security Specialist – Intermediate capacity to support the Cyber Security Defence Operations team with hands‑on operational initiatives for Ontario Health (OH).

This role is explicitly hands‑on and operational, requiring the resource to collaborate across teams (SOC, Dev Ops, cloud engineering) to implement and execute solutions rather than just providing recommendations.

The role focuses on two primary areas

• Continuous Threat Exposure Management (CTEM): Leading the design, operationalization, and execution of a CTEM program.

This involves threat exposure and attack path analysis, validation of exploitability, and risk‑based prioritization.

The resource will strengthen workflows between CTEM, SOC, and vulnerability management, using Security Copilot and security automation agents for AI‑assisted analysis and data correlation.

• Dev Sec Ops Pipeline Security & Cloud Security Posture Management (CSPM): Embedding security into the software development lifecycle (SDLC) and CI/CD pipelines.

This includes integrating automated security testing tools (SAST, DAST, SCA, container/Ia C scanning) to achieve a "shift-left" approach.

In parallel, the resource will oversee CSPM and Cloud‑Native Application Protection Platform (CNAPP) operations across OH’s AWS and Azure environments to identify misconfigurations, runtime threats, and reduce overall cloud risk.

Responsibilities

• CTEM & Exposure Management
• Day-to-Day

Operations: Execute continuous threat, exposure, and attack surface risk analysis.

Daily review and monitor vulnerabilities, misconfigurations, identity risks, and externally exposed assets using Microsoft Defender, Tenable, Prisma Cloud, and native Azure/AWS security services.

• Threat
• Intelligence

Integration: Analyze daily threat intelligence feeds, vulnerability disclosures, and emerging cyber threat trends to assess organizational impact and drive risk‑based response activities.

• Prioritization & Remediation: Evaluate and score exposures based on exploitability, impact, and threat intelligence.

Develop risk‑based remediation plans and collaborate with IT and application teams to ensure critical issues are addressed promptly.

• Dev Sec Ops & Cloud Security Operations
• CI/CD Pipeline

Integration: Collaborate with Dev Ops teams to automate, tune, and embed SAST, DAST, SCA, and Infrastructure‑as‑Code (Ia C) security scanning into build/release workflows, minimizing false positives.

• Secure Coding Support: Provide technical guidance and best practices to development teams to help remediate vulnerabilities found during pipeline scans.
• Cloud
• Posture

Management: Configure and operate CSPM/CNAPP tools to continuously monitor the security posture of AWS and Azure environments.

Identify and categorize risks such as open storage buckets, overly permissive roles, or unpatched workloads.

• Risk Remediation: Partner directly with cloud engineering and operations teams to execute fixes for identified cloud risks.
• Required Skills & Experience
• Experience: 5–8 years of experience in cyber security, with a strong background in security operations, vulnerability management, or Dev Sec Ops programs.
• CTEM Program

Execution: Proven experience running a continuous threat exposure management or advanced vulnerability management program, including exposure discovery, threat scenario analysis, attack‑path mapping, and risk‑based prioritization.

• Dev Sec
• Ops

Engineering: Deep hands‑on experience integrating security testing tools (SAST, DAST, SCA, Ia C, container scanning) into automated CI/CD pipelines and source control workflows.

• Multi‑Cloud

Security: In‑depth hands‑on knowledge of securing AWS and Azure environments, including identity management (IAM), network security controls, monitoring/logging (Cloud Trail, Cloud Watch, Azure Monitor), and threat detection services (Guard Duty, Azure Defender/Sentinel).

• CSPM/CNAPP Operations: Practical experience operating, configuring, and tuning cloud posture platforms (e. g., Prisma Cloud or similar) to match organizational risk tolerance.
• Communication & Teamwork: Strong verbal and written communication skills.

Demonstrated ability to break down silos, collaborate across multi‑disciplinary technical teams, and translate complex security data into clear technical documentation or executive summaries.

• Desired Skills
• Healthcare/Public Sector: Prior experience working within healthcare or public sector environments, particularly within the Ontario health sector.
• Defense Operations: Direct exposure to or participation in proactive threat intelligence and threat hunting activities.
• Cloud‑Native Architecture: Knowledge of modern containerization and cloud‑native practices, including Kubernetes security and microservices architecture.
• Professional Certifications: Relevant certifications such as CISSP, CISM, GIAC, or Azure Security Engineer.
• #J-18808-Ljbffr