Security Specialist

Job Summary:

The Intermediate Security Specialist is responsible for developing and executing advanced cybersecurity programs focused on continuous threat exposure management, vulnerability management, and DevSecOps practices. This role emphasizes securing cloud environments, integrating security within CI/CD pipelines, and collaborating across teams to enhance organizational security posture, particularly within healthcare or public sector contexts.

Responsibilities:

• Develop and manage continuous threat exposure management (CTEM) and vulnerability management programs.
• Implement and maintain secure DevSecOps practices within CI/CD pipelines, including SAST, DAST, container, and IaC security scanning.
• Operate and optimize Cloud Security Posture Management (CSPM) or CNAPP solutions to assess and improve cloud security.
• Design and integrate complex security solutions into daily operations and workflows.
• Perform risk-based analysis to prioritize remediation efforts and communicate findings to technical and non-technical stakeholders.
• Collaborate with multidisciplinary teams including security, IT, DevOps, cloud, and business units to drive security initiatives.
• Produce clear technical documentation, security reports, and executive-level summaries.
• Stay current with emerging threats, technologies, and best practices to continuously enhance security measures.
• Mentor and support team members to build internal security capabilities.

Required Skills:

• 5 8 years of cybersecurity experience with focus on security operations, vulnerability management, or DevSecOps.
• Proven experience implementing and running CTEM or advanced vulnerability management programs.
• Hands-on expertise with secure CI/CD pipeline integration (SAST, DAST, container security, IaC scanning).
• Strong cloud security knowledge in AWS and Azure, including IAM, network security, logging, monitoring, and encryption.
• Operational experience with CSPM/CNAPP tools (e.g., Prisma Cloud) for continuous cloud posture assessment.
• Excellent communication skills for technical documentation and stakeholder engagement.

Desired Skills:

• Experience in healthcare or public sector environments, especially within the Ontario health sector.
• Exposure to threat intelligence and threat hunting activities.
• Knowledge of containerization, Kubernetes security, and microservices architecture.
• Relevant security certifications such as CISSP, CISM, GIAC, or Azure Security Engineer.
• Familiarity with cloud-native application development practices.

Rated Criteria:

• Continuous Threat Exposure Management Expertise - 30 Points
• DevSecOps and Secure CI/CD Pipeline Implementation - 25 Points
• Cloud Security (AWS & Azure) and CSPM Operations - 25 Points
• Communication and Collaboration Skills - 10 Points
• Healthcare/Public Sector Experience and Threat Intelligence Exposure - 10 Points

Total: 100 Points Deliverables:

• Established and operational CTEM or vulnerability management program with documented processes.
• Secure CI/CD pipelines integrated with automated security scanning tools.
• Configured and optimized CSPM/CNAPP platform aligned with organizational policies.
• Risk-based prioritization reports and remediation plans communicated to stakeholders.
• Technical documentation and executive summaries detailing security posture and initiatives.
• Knowledge transfer and mentorship materials for internal team upskilling.

Must Haves:

• Minimum 5 years of relevant cybersecurity experience.
• Hands-on experience with CTEM or continuous vulnerability management programs.
• Proven ability to implement security in DevSecOps environments and cloud platforms.
• Strong cloud security expertise in AWS and Azure.
• Excellent communication and stakeholder engagement skills.

Public Sector Experience:

Preferred