RQ00816 - Security Specialist - Intermediate I Ontario Health I Hybrid

Job Title: RQ00816 - Security Specialist - Intermediate

Location: Toronto ON , Hybrid

Pay Rate:55-63/hr

Description

Background Information

The purpose of this request is to procure a contingent cyber security resource in a Security Specialist – Intermediate capacity to support the Cyber Security Defence Operations team with hands-on operational initiatives for Ontario Health (OH).

This role is explicitly hands-on and operational, requiring the resource to collaborate across teams (SOC, DevOps, cloud engineering) to implement and execute solutions rather than just providing recommendations. The role focuses on two primary areas:

• Continuous Threat Exposure Management (CTEM): Leading the design, operationalization, and execution of a CTEM program. This involves threat exposure and attack path analysis, validation of exploitability, and risk-based prioritization. The resource will strengthen workflows between CTEM, SOC, and vulnerability management, using Security Copilot and security automation agents for AI-assisted analysis and data correlation.

• DevSecOps Pipeline Security & Cloud Security Posture Management (CSPM): Embedding security into the software development lifecycle (SDLC) and CI/CD pipelines. This includes integrating automated security testing tools (SAST, DAST, SCA, container/IaC scanning) to achieve a "shift-left" approach. In parallel, the resource will oversee CSPM and Cloud-Native Application Protection Platform (CNAPP) operations across OH’s AWS and Azure environments to identify misconfigurations, runtime threats, and reduce overall cloud risk.

Responsibilities

CTEM & Exposure Management

• Day-to-Day Operations: Execute continuous threat, exposure, and attack surface risk analysis. Daily review and monitor vulnerabilities, misconfigurations, identity risks, and externally exposed assets using Microsoft Defender, Tenable, Prisma Cloud, and native Azure/AWS security services.

• Threat Intelligence Integration: Analyze daily threat intelligence feeds, vulnerability disclosures, and emerging cyber threat trends to assess organizational impact and drive risk-based response activities.

• Prioritization & Remediation: Evaluate and score exposures based on exploitability, impact, and threat intelligence. Develop risk-based remediation plans and collaborate with IT and application teams to ensure critical issues are addressed promptly.

DevSecOps & Cloud Security Operations

• CI/CD Pipeline Integration: Collaborate with DevOps teams to automate, tune, and embed SAST, DAST, SCA, and Infrastructure-as-Code (IaC) security scanning into build/release workflows, minimizing false positives.

• Secure Coding Support: Provide technical guidance and best practices to development teams to help remediate vulnerabilities found during pipeline scans.

• Cloud Posture Management: Configure and operate CSPM/CNAPP tools to continuously monitor the security posture of AWS and Azure environments. Identify and categorize risks such as open storage buckets, overly permissive roles, or unpatched workloads.

• Risk Remediation: Partner directly with cloud engineering and operations teams to execute fixes for identified cloud risks.

Required Skills & Experience

• Experience: 5–8 years of experience in cyber security, with a strong background in security operations, vulnerability management, or DevSecOps programs.

• CTEM Program Execution: Proven experience running a continuous threat exposure management or advanced vulnerability management program, including exposure discovery, threat scenario analysis, attack-path mapping, and risk-based prioritization.

• DevSecOps Engineering: Deep hands-on experience integrating security testing tools (SAST, DAST, SCA, IaC, container scanning) into automated CI/CD pipelines and source control workflows.

• Multi-Cloud Security: In-depth hands-on knowledge of securing AWS and Azure environments, including identity management (IAM), network security controls, monitoring/logging (CloudTrail, CloudWatch, Azure Monitor), and threat detection services (GuardDuty, Azure Defender/Sentinel).

• CSPM/CNAPP Operations: Practical experience operating, configuring, and tuning cloud posture platforms (e.g., Prisma Cloud or similar) to match organizational risk tolerance.

• Communication & Teamwork: Strong verbal and written communication skills. Demonstrated ability to break down silos, collaborate across multi-disciplinary technical teams, and translate complex security data into clear technical documentation or executive summaries.

Desired Skills

• Healthcare/Public Sector: Prior experience working within healthcare or public sector environments, particularly within the Ontario health sector.

• Defense Operations: Direct exposure to or participation in proactive threat intelligence and threat hunting activities.

• Cloud-Native Architecture: Knowledge of modern containerization and cloud-native practices, including Kubernetes security and microservices architecture.

• Professional Certifications: Relevant certifications such as CISSP, CISM, GIAC, or Azure Security Engineer.