Application Security Analyst

About our client

Our client is a leading Canadian financial services organization that has been helping investors build better financial futures for over 35 years. Offering individuals and institutions a comprehensive suite of trusted investment portfolios and services, they boldly embrace innovation across all business areas. Working here means joining a diverse, dedicated, and inclusive team where employees feel valued and supported to achieve their personal and professional best.

Role Overview

This Information Security Analyst position plays a vital role in protecting corporate information assets by providing technical oversight and supporting security policies and procedures. As part of an initiative to standardize security processes across shared services, this role directly supports risk mitigation across the organization. In your first 6 to 12 months, you will make an immediate impact by ensuring software development life cycle (SDLC) security compliance, performing vulnerability assessments, conducting third-party SaaS vendor reviews, and supporting disaster recovery operations.

Main Responsibilities

• Ensure that the software development life cycle complies with information security policies regarding secure coding and secure access controls.
• Perform vulnerability analysis and issues management for pre-production and production applications using standard vulnerability scanning tools.
• Review and challenge proposed changes to application controls, including data encryption, user security profiles/bands, and input/output integrity checks (edit checks, control totals, data validation).
• Conduct External Security Reviews on third-party vendors and SaaS providers accessing confidential data or performing critical business functions.
• Assess cloud vendors and SaaS platforms from an information security requirements perspective.
• Monitor Data Loss Prevention (DLP) tools, conduct security investigations, and assist with Security Training & Awareness initiatives.
• Support Disaster Recovery (DR) operations, including participating in scheduled DR tests and assisting the DR team.

Must-have required skills and experience

• Experience & Industry: 2 to 3 years of relevant experience, with a strong preference for a financial services background.
• Education: Bachelor’s degree in Information Technology, Computer Science, or a related discipline (or equivalent practical experience).
• Technical Domain Knowledge: Knowledge of vulnerability assessments, secure code and infrastructure reviews, secure access modeling, threat modeling, and digital security architecture.
• Cloud & Audit Standards: Solid understanding of cloud security capabilities (AWS, Azure) and industry audit standards, including PCI-DSS, SSAE-16, and FFIEC.
• Soft Skills: Exceptional interpersonal, collaboration, written, presentation, and multi-tasking skills to work effectively with cross-functional technical and business stakeholders.

Nice-to-have skills

• Experience with enterprise scanning and workflow platforms such as Fortify, Veracode, Checkmarx, AppScan, or ServiceNow.
• Professional certifications such as CISSP or Cloud Security certifications.
• A software development background.

Logistics & Compensation

• Location/Work Mode: Hybrid arrangement - 2 flexible days per week in-office. The position is based in Toronto until late 2026, transitioning to Mississauga.
• Employment Type: Full-time, permanent position.
• Compensation: Base salary of $80,000 to $90,000 + 15% performance bonus