This role will focus on two primary areas:
Continuous Threat Exposure Management (CTEM) : Leading the design and operationalization of a CTEM program that provides continuous visibility into the organization’s cyber exposure. This includes threat exposure analysis, attack path analysis, validation of remediation through testing, and risk-based prioritization to ensure critical issues are addressed first.. The resource will strengthen coordination between CTEM, SOC, and vulnerability management workflows, ensuring that exposure findings translate into actionable improvements in monitoring, detection, and response.
Demonstrated hands-on experience using Security Copilot and security automation agents to support CTEM execution, including AI-assisted threat analysis, correlation of exposure data, attack‑path analysis, and validation of exploitability
DevSecOps Pipeline Security & Cloud Security Posture Management: Implementing and enhancing DevSecOps practices by embedding security into the software development lifecycle (SDLC) and CI/CD pipelines. The resource will lead the integration of security testing tools (SAST, DAST, SCA, container/IaC scanning) into automated build processes, ensuring vulnerabilities are identified and addressed as early as possible (“shift-left” approach). In parallel, the role will oversee cloud security posture management (CSPM) and cloud-native application protection platform (CNAPP) operations across OH’s AWS and Azure environments, to continuously monitor and remediate cloud security risks. This involves implementing a CSPM/CNAPP solution to identify misconfigurations, insecure practices, and runtime threats, and working with cloud teams to reduce risk.
This role is explicitly hands-on and operational. It requires a strong technical background in cyber defense operations and the ability to execute and deliver tangible outcomes in the areas above. The resource will be expected to work across teams (SOC, DevOps, cloud engineering, etc.) to implement and execute, rather than only providing recommendations.
Responsibilities:
a. CTEM & Exposure Management:
- Operate
and Mature Day‑to‑Day CTEM Activities: Execute continuous, day‑to‑day
threat and exposure analysis as part of regular CTEM operations. This
includes daily review and analysis of attack surface risk using Microsoft
Defender, Tenable, Prisma Cloud, and native Azure and AWS security
services, to identify vulnerabilities, misconfigurations, identity risks,
and externally exposed assets requiring immediate attention.
- Perform
day-to-day threat analysis leveraging multiple threat intelligence
sources, vulnerability disclosures, emerging cyber threat trends, and
security advisories to assess organizational impact and drive risk-based
response and remediation activities.
- Risk-Based
Prioritization & Remediation: Implement mechanisms to assess and score
exposures based on exploitability, potential impact, and relevant threat
intelligence. Develop risk-based remediation plans and work with IT and
application teams to ensure that critical exposures are remediated
promptly. Provide clear communication of risk rankings and recommended
actions to stakeholders.
b. DevSecOps & Cloud Security Operations:
- DevSecOps
Pipeline Integration: Collaborate with software development and DevOps
teams to embed security testing into the CI/CD pipelines. Implement and
tune SAST, DAST, SCA, and Infrastructure-as-Code scanning tools so that
code, dependencies, and cloud templates are scanned for vulnerabilities
with each build/release. Ensure that these processes are automated and
produce actionable results for developers, with minimal false positives.
- Secure
Coding & Remediation Support: Provide guidance and best practices to
development teams on resolving vulnerabilities identified through pipeline
scans.
- Cloud
Security Posture Management: Take ownership of monitoring and improving
the security posture of OH’s AWS and Azure environments. Regularly review
cloud configurations and identify misconfigurations or compliance gaps
(e.g., open storage buckets, overly permissive roles, unpatched
workloads). Configure and operate a CSPM/CNAPP tool to continuously
detect, categorize, and report such issues.
- Cloud
Risk Remediation & Integration: Work with cloud engineering and
operations teams to remediate identified cloud risks
Desired Skills:
- Experience in healthcare or public sector environments,
particularly Ontario health sector
- Prior exposure to or participation in threat intelligence
and threat hunting activities.
- Knowledge of modern containerization and cloud-native
application development practices, including Kubernetes security and
microservices architecture, as a plus.
- Relevant certifications (e.g., CISSP, CISM, GIAC, Azure
Security Engineer)
Required Skills:
- Minimum 5–8 years of experience in cyber security, with
extensive exposure to security operations and vulnerability management or
devSecOps programs
- Proven experience developing and executing a continuous
threat exposure management or advanced vulnerability management program (e.g.,
CTEM), including continuous discovery of exposures, threat scenario analysis,
attack-path mapping, and risk-based prioritization of remediation actions.
- Deep DevSecOps experience, with hands-on implementation of
secure CI/CD pipeline practices (integrating SAST, DAST, SCA, IaC security
scanning, container security scans) in collaboration with development/DevOps
teams.
- Strong cloud security expertise across AWS and Azure,
including practical knowledge of cloud-native security controls (IAM, network
security groups, logging/monitoring, encryption) and cloud threat detection
services (e.g., AWS GuardDuty, Azure Defender/Sentinel).
- In-depth experience operating a Cloud Security Posture
Management (CSPM) or CNAPP solution (e.g., Prisma Cloud or similar) to
continually assess and improve cloud posture.
- Excellent written and verbal communication skills, with the
ability to produce clear technical documentation, reports, and executive-level
summaries.
Strong expertise in:
- Continuous Threat Exposure Management and Vulnerability
Management: Hands-on experience running programs that continuously identify and
mitigate security exposures, aligning closely with organizational risk
tolerance.
- DevSecOps and Secure SDLC: Proven ability to implement and
manage security controls within CI/CD pipelines, and to work with DevOps tools
and processes (source control, CI servers, container platforms, etc.) to
improve software security.
- Cloud Security (AWS & Azure): In-depth hands-on
knowledge of securing cloud environments, including identity management,
network security, monitoring (CloudTrail, CloudWatch, Azure Monitor), and
secure configuration of cloud services.
- CSPM/CNAPP Solutions: Operational experience with cloud
security posture management platforms, and the ability to configure and tune
these tools to an organization’s environment and policies.
Demonstrated ability to:
- Design and implement complex security solutions and
processes, ensuring they are effectively integrated into everyday operations
(e.g., implementing CTEM processes and ensuring follow-through; integrating new
security tools so they are used consistently by teams).
- Perform risk-based analysis and prioritization, evaluating
where to focus security resources for maximum impact and articulating the
rationale to stakeholders.
- Collaborate across multidisciplinary teams (security, IT,
DevOps, cloud, business) to drive security initiatives, overcoming silos and
aligning efforts with organizational objectives.
- Communicate complex security issues and solutions clearly,
adjusting the level of detail for technical teams versus leadership or
non-technical stakeholders.
Solid understanding of:
- Modern cyber threat landscape and attack vectors
- Security architecture principles in both on-premises and
cloud environments
Core competencies:
- Strong focus on execution, delivery, and measurable outcomes
- Strong analytical and problem-solving skills, enabling the
resource to dissect complex security problems, identify root causes, and
develop creative solutions.
- Execution and delivery focus, demonstrating a bias toward
action and results – setting clear goals, meeting deadlines, and delivering
high-quality outputs that measurably improve security posture.
- Adaptability and continuous learning, staying current with
emerging threats, new security technologies, and best practices, and quickly
adjusting approaches as the environment evolves.
- Teamwork and mentorship, working well within team settings,
sharing knowledge, and helping to upskill internal team members throughout the
engagement.
Requirements
Required Experience:
1.Continuous Threat Exposure Management
(CTEM) Experience :
- Demonstrated
experience establishing or significantly contributing to a CTEM or
continuous vulnerability management program.
- Hands-on
experience running programs that continuously identify and mitigate
security exposures, aligning closely with organizational risk
tolerance.
- Perform
risk-based analysis and prioritization, evaluating where to focus security
resources for maximum impact and articulating the rationale to
stakeholders.
2.DevSecOps & Application Security Experience:
- Hands-on
experience integrating security into CI/CD pipelines (implementing SAST,
DAST, container security, etc.).
- Experience
collaborating with development/DevOps teams to remediate security issues
and improve secure coding practices.
- Familiarity
with infrastructure-as-code (IaC) and managing security in containerized
or cloud-native application environments.
3.Cloud Security & CSPM Operations :
- Strong
experience with AWS and Azure security controls and best practices.
- Proven
operation of a CSPM or CNAPP platform (e.g., configuring rules, analyzing
findings, managing remediation workflows).
- Ability
to align cloud security initiatives with overall security program and
compliance requirements.
Deliverables
Continuous Threat Exposure Management (CTEM)
- Operate and Mature Day‑to‑Day CTEM Activities: Execute continuous, day‑to‑day threat and exposure analysis as part of regular CTEM operations. This includes daily review and analysis of attack surface risk using Microsoft Defender, Tenable, Prisma Cloud, and native Azure and AWS security services, to identify vulnerabilities, misconfigurations, identity risks, and externally exposed assets requiring immediate attention.
- Perform day-to-day threat analysis leveraging multiple threat intelligence sources, vulnerability disclosures, emerging cyber threat trends, and security advisories to assess organizational impact and drive risk-based response and remediation activities.
- Risk-Based Prioritization & Remediation: Implement mechanisms to assess and score exposures based on exploitability, potential impact, and relevant threat intelligence. Develop risk-based remediation plans and work with IT and application teams to ensure that critical exposures are remediated promptly. Provide clear communication of risk rankings and recommended actions to stakeholders.
DevSecOps
- Pipeline Security Integration: Implement and document security scanning integration within CI/CD pipelines. Collaborate with software development and DevOps teams to embed security testing into the CI/CD pipelines. Implement and tune SAST, DAST, SCA, and Infrastructure-as-Code scanning tools so that code, dependencies, and cloud templates are scanned for vulnerabilities with each build/release. Ensure that these processes are automated and produce actionable results for developers, with minimal false positives.
- Secure Coding & Remediation Support: Provide guidance and best practices to development teams on resolving vulnerabilities identified through pipeline scans.
- DevSecOps Findings & Metrics: Deliver periodic summaries of vulnerabilities detected in pipelines, highlighting trends (e.g., common weakness types in code or configurations) and improvements over time as DevSecOps practices mature. Use these metrics to demonstrate progress (e.g., reduction in average vulnerabilities per build) and to inform further training or tool tuning.
- Secure Development Standards & Training Materials: Develop or update secure coding and DevSecOps best-practice documents tailored to OH’s development environment. This may include guidelines for secure coding, secure use of open source libraries, and secure container configuration. If needed, conduct workshops or knowledge-sharing sessions (with training slides or quick reference materials as deliverables) to educate developers on these standards.
Cloud Security Posture Management (CSPM) & Cloud Defense
- Cloud Security Assessment & Gap Analysis: Conduct an initial end-to-end cloud security posture assessment of OH’s AWS and Azure environments. Produce a report of findings that details misconfigurations, compliance issues, and risk areas (e.g., unsecured interfaces, improper access settings, etc.), along with severity ratings. This will serve as a baseline for improvement.
- CSPM/CNAPP Implementation: Fully deploy and configure the CSPM/CNAPP platform for multi-cloud coverage. Deliver a configuration summary and operations guide for the platform, including configured policies, alert thresholds, and integration points (such as ticketing or notification systems). Ensure that the platform is set up to provide actionable alerts to the appropriate teams.
- Remediation Playbooks: For common or critical cloud findings (e.g., an S3 bucket made public, or unencrypted database instances), develop remediation playbooks or runbooks. These should outline the steps for remediation and include any automation scripts if available, enabling faster response when similar issues are detected in the future.
Additional Deliverables:
- Deliverables are not limited to the above and may evolve based on organizational priorities, emerging threats, or changes in the security environment during the engagement. The resource is expected to adapt to changing requirements and contribute broadly to overall security program maturity and operational resilience as needed.
Must Haves:
- Continuous Threat Exposure Management (CTEM) Experience :
- Demonstrated experience establishing or significantly contributing to a CTEM or continuous vulnerability management program.
- Hands-on experience running programs that continuously identify and mitigate security exposures, aligning closely with organizational risk tolerance.
- Perform risk-based analysis and prioritization, evaluating where to focus security resources for maximum impact and articulating the rationale to stakeholders.
2.DevSecOps & Application Security Experience:
- Hands-on experience integrating security into CI/CD pipelines (implementing SAST, DAST, container security, etc.).
- Experience collaborating with development/DevOps teams to remediate security issues and improve secure coding practices.
- Familiarity with infrastructure-as-code (IaC) and managing security in containerized or cloud-native application environments.
3.Cloud Security & CSPM Operations :
- Strong experience with AWS and Azure security controls and best practices.
- Proven operation of a CSPM or CNAPP platform (e.g., configuring rules, analyzing findings, managing remediation workflows).
- Ability to align cloud security initiatives with overall security program and compliance requirements.
