RQ00816 - Security Specialist - Intermediate I Ontario Health I Hybrid at Analyst Technical Solutions — NeverHard

Job DescriptionJob Description Job Title: RQ00816 - Security Specialist - Intermediate Location: Toronto ON , Hybrid Pay Rate:55-63/hr Description Background Information The purpose of this request is to procure a contingent cyber security resource in a Security Specialist – Intermediate capacity to support the Cyber Security Defence Operations team with hands-on operational initiatives for Ontario Health (OH). This role is explicitly hands-on and operational, requiring the resource to collaborate across teams (SOC, DevOps, cloud engineering) to implement and execute solutions rather than just providing recommendations. The role focuses on two primary areas: • Continuous Threat Exposure Management (CTEM): Leading the design, operationalization, and execution of a CTEM program. This involves threat exposure and attack path analysis, validation of exploitability, and risk-based prioritization. The resource will strengthen workflows between CTEM, SOC, and vulnerability management, using Security Copilot and security automation agents for AI-assisted analysis and data correlation. • DevSecOps Pipeline Security & Cloud Security Posture Management (CSPM): Embedding security into the software development lifecycle (SDLC) and CI/CD pipelines. This includes integrating automated security testing tools (SAST, DAST, SCA, container/IaC scanning) to achieve a "shift-left" approach. In parallel, the resource will oversee CSPM and Cloud-Native Application Protection Platform (CNAPP) operations across OH’s AWS and Azure environments to identify misconfigurations, runtime threats, and reduce overall cloud risk. Responsibilities CTEM & Exposure Management • Day-to-Day Operations: Execute continuous threat, exposure, and attack surface risk analysis. Daily review and monitor vulnerabilities, misconfigurations, identity risks, and externally exposed assets using Microsoft Defender, Tenable, Prisma Cloud, and native Azure/AWS security services. • Threat Intelligence Integration: Analyze daily threat intelligence feeds, vulnerability disclosures, and emerging cyber threat trends to assess organizational impact and drive risk-based response activities. • Prioritization & Remediation: Evaluate and score exposures based on exploitability, impact, and threat intelligence. Develop risk-based remediation plans and collaborate with IT and application teams to ensure critical issues are addressed promptly. DevSecOps & Cloud Security Operations • CI/CD Pipeline Integration: Collaborate with DevOps teams to automate, tune, and embed SAST, DAST, SCA, and Infrastructure-as-Code (IaC) security scanning into build/release workflows, minimizing false positives. • Secure Coding Support: Provide technical guidance and best practices to development teams to help remediate vulnerabilities found during pipeline scans. • Cloud Posture Management: Configure and operate CSPM/CNAPP tools to continuously monitor the security posture of AWS and Azure environments. Identify and categorize risks such as open storage buckets, overly permissive roles, or unpatched workloads. • Risk Remediation: Partner directly with cloud engineering and operations teams to execute fixes for identified cloud risks. Required Skills & Experience • Experience: 5–8 years of experience in cyber security, with a strong background in security operations, vulnerability management, or DevSecOps programs. • CTEM Program Execution: Proven experience running a continuous threat exposure management or advanced vulnerability management program, including exposure discovery, threat scenario analysis, attack-path mapping, and risk-based prioritization. • DevSecOps Engineering: Deep hands-on experience integrating security testing tools (SAST, DAST, SCA, IaC, container scanning) into automated CI/CD pipelines and source control workflows. • Multi-Cloud Security: In-depth hands-on knowledge of securing AWS and Azure environments, including identity management (IAM), network security controls, monitoring/logging (CloudTrail, CloudWatch, Azure Monitor), and threat detection services (GuardDuty, Azure Defender/Sentinel). • CSPM/CNAPP Operations: Practical experience operating, configuring, and tuning cloud posture platforms (e.g., Prisma Cloud or similar) to match organizational risk tolerance. • Communication & Teamwork: Strong verbal and written communication skills. Demonstrated ability to break down silos, collaborate across multi-disciplinary technical teams, and translate complex security data into clear technical documentation or executive summaries. Desired Skills • Healthcare/Public Sector: Prior experience working within healthcare or public sector environments, particularly within the Ontario health sector. • Defense Operations: Direct exposure to or participation in proactive threat intelligence and threat hunting activities. • Cloud-Native Architecture: Knowledge of modern containerization and cloud-native practices, including Kubernetes security and microservices architecture. • Professional Certifications: Relevant certifications such as CISSP, CISM, GIAC, or Azure Security Engineer.