SENIOR INFORMATION SECURITY ANALYST (HYBRID)

Job Responsibility:

WHO WE ARE When it comes to health, we're always looking for ways to push for better. It's why we were founded in the first place. In 1957, our founder, pharmacist William Wilkinson, witnessed a mother sacrifice her health by forgoing her own medicine to pay for her sick daughter's prescription. He knew there had to be a better way. So, he introduced North America's first prepaid drug plan, and GreenShield was born as a not-for-profit with a mission to support better health for all Canadians.

We aren't just a health and benefits company. We're the only not-for-profit social enterprise that brings worlds of coverage and care together, all in one place. We're noble challengers, purposefully building a better way and we need the best people to help us create a more holistic approach that takes care of the mind and body. Our mission is to create better health for all Canadians, and we know that starts with our employees.

THE ROLE IN A NUTSHELL

• Manages the enforcement of corporate, regulatory, and risk management policies and assists in developing, maintaining, and publishing corporate information security standards, procedures, and guidelines for enterprise and cloud computing platforms.
• Provides subject matter expertise to departments on issues of Information Security, including technical guidance.
• Creates and maintains logical security reporting that facilitates logical security monitoring. Provides guidance to user security administrators responsible for specific application security.
• Design, implement, and maintain robust security measures to safeguard cloud environments in Microsoft Azure Cloud, Google Cloud Platform (GCP), and Amazon Web Services (AWS).
• Performs technical lead functions for security projects, applications and systems and manages and investigates local security incidents. Implements upgrades, repairs, modifications, and replacements of information security devices or software.
• Plans and implements security and integrity controls over applications including Microsoft and Google Cloud Platform
• Provisions access to internally developed and cloud-based applications through the enterprise IAM tool, enforcing enterprise ITSM practices.
• Analyzes SOC related alerts and owns the relationship with the SOCaaS Provider.
• Analyzes application security needs based on the sensitivity or proprietary nature of the data, and ensures all systems are utilized for management-approved purposes only
• Provides technical expertise and guides the administration of security tools that control and monitor information security.
• Provides required support during disaster recovery activities necessary to recover critical services in the event of a declared disaster, providing direction and in-house consulting in these areas.
• Researches, evaluates, designs, tests, recommends, and plans implementation of new or improved information security software or devices.
• Participates in audit reviews for organizational compliance, including artifact gathering and deficiency remediation.
• Trains information owners and officers in the implementation of necessary computer security controls or new upgraded security software and devices. Develops and implements information security educational programs, conducting awareness seminars and workshops as appropriate
• Provides mentorship and support to other security team members.

WHO WE'RE LOOKING FOR

• Bachelor's degree in Computer Science, Engineering, or related discipline
• This role will have exposure to Protected B data as per Public Service and Procurement Canada requirements. The successful candidate must acquire and maintain Reliability Status to be eligible for this position. 8 or more years in IT Security
• Solid multi-platform knowledge including operational and security considerations. Experience in UNIX, Windows, Linux, and networed security environments including firewalls, intrusion detection, incident response, IAM, PAM, SOC, vulnerability testing, operating system hardening, regulatory compliance, and data classification. Knowledge of SIEM and EDR/XDR platforms.
• Highly desirable are certifications in one or more of the following: Cloud - CCSK, CCSP, CISSP, CSSLP, SSCP, CEH, Google, Microsoft Azure, M365, Security, Nessus, Tenable.io, Possession of one or more of the SC-300, SC-200, SC-400, and SC-900 certifications, with a nice-to-have SC-100 certification.
• Google Cloud Security Analyst certification is mandatory.
• Demonstrated competency in strategic thinking with strong abilities in relationship management
• Successful development and implementation of new technology
• Demonstrated competency in developing effective solutions to diverse and complex business problems
• Understanding of program development including building process documentation, workflows and RACIs.
• Technical proficiency in security-related hardware and software; ability to function as a consultant to other IT groups on security matters as a recognized technical expert and to lead teams
• Ability to analyze technical and business risks to make recommendations for security controls and/or compensating corrective actions
• Deep knowledge of security tools including firewalls, IDS, IPS, SIEM, IAM, PAM and their configuration and management.
• Specific experience with Saviynt, BeyondTrust Bomgar, BeyondTrust PAM, Azure Sentinel, Microsoft Defender, and Google Security Command Center would be an asset
• Experience implementing security solutions, policies, and technologies relating to transactional web sites is an asset.
• Penetration testing experience is an asset.
• A self-starter who can work under minimal supervision, requiring little to no instruction on day-to-day work and general direction on complex tasks and projects
• Strong analytical and problem-solving skills
• Strong oral and written communications skills; ability to present and discuss technical information in a way that establishes rapport, persuades others, and gains understanding
• Strong team-oriented interpersonal skills; ability to effectively interface with a wide variety of people

THE CULTURE We believe a career should be meaningful. Not just a means to earn a living. Our culture is one where everyone's voice is heard and valued. Because that's what it takes to create better health for all. We dare to challenge the status quo. And we're driven by people who have challenged theirs. We believe that your workplace should empower you to be the best version of yourself. That's why we provide a place where you can be inspired, challenged, and rewarded. Where your growth means our growth. Where your voice is heard and valued. Where your work has purpose. And purpose matters. We believe our people are critical to our overall success. Inclusivity makes us a stronger, smarter and more informed organization. Being intentionally inclusive of diverse backgrounds, perspectives and experiences will enhance our company culture to positively impact how we support our communities. A career at GreenShield isn't just about personal achievements, it's about making a difference together. Here's to Better Health for All!

A FEW MORE DETAILS Proficiency in English is required for this position. As part of this role, you will be required to communicate with colleagues or customers who use English as their primary language. By requiring English proficiency for this position, we aim to ensure that our employees can excel in their roles, collaborate, and communicate effectively, and contribute to the success of our organization.

GS supports diversity, equity and inclusion in our teams and communities, and we value the unique contributions made by all. Even if your experience doesn't align perfectly to every requirement, we invite you to apply. We encourage applications from all candidates and will accommodate needs under human rights legislation throughout all stages of the recruitment and selection process. Please let us know of any accommodation through View email address on ca.edajobs.com. Information received relating to accommodation will be addressed confidentially.

Providing this information gives GS consent to use your personal information to assess your suitability for specific positions, future opportunities or for your personnel file. Your résumé will be held in strict confidence and will be viewed only by the Organization. Information may be stored outside of Canada and could be used for aggregate statistical purposes (which uses no personal identification).