Client: Supply Ontario – RQ00816
We are seeking an experienced
Security Specialist – Intermediate with strong hands-on expertise in Continuous Threat Exposure Management (CTEM), vulnerability management, DevSecOps, application security, and cloud security posture management across AWS and Azure environments. The successful candidate will support Ontario Health’s Cyber Security Defence Operations team by operationalizing CTEM activities, integrating security controls into CI/CD pipelines, implementing and managing CSPM/CNAPP solutions, prioritizing security exposures based on risk, and working collaboratively with SOC, DevOps, cloud engineering, and IT teams to deliver measurable improvements in cybersecurity posture and operational resilience.
Role Snapshot
- Job Title: RQ00816 – Security Specialist – Intermediate
- Client: Supply Ontario
- Work Location: 525 University Avenue, Toronto, Ontario, Canada
- Work Arrangement: Hybrid – Up to 3 Days Onsite, Subject to Hiring Manager’s Discretion
- Estimated Start Date: November 30, 2026
- Estimated End Date: August 10, 2027
- Business Days: 175.00
- Extension: Option to extend for 250 business days at the Agency’s discretion, with additional provisions for unused business days
- Hours: 7.25 hours per day, 5 days per week
- Public Sector Experience: Nice to Have
Must Have
Continuous Threat Exposure Management (CTEM) Experience
- Demonstrated experience establishing or significantly contributing to a CTEM or continuous vulnerability management program.
- Hands-on experience running programs that continuously identify and mitigate security exposures, aligning closely with organizational risk tolerance.
- Perform risk-based analysis and prioritization, evaluating where to focus security resources for maximum impact and articulating the rationale to stakeholders.
DevSecOps & Application Security Experience
- Hands-on experience integrating security into CI/CD pipelines, including implementing Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), container security, and related controls.
- Experience collaborating with development and DevOps teams to remediate security issues and improve secure coding practices.
- Familiarity with Infrastructure as Code (IaC) and managing security in containerized or cloud-native application environments.
Cloud Security & CSPM Operations
- Strong experience with AWS and Azure security controls and best practices.
- Proven experience operating a Cloud Security Posture Management (CSPM) or Cloud-Native Application Protection Platform (CNAPP), including configuring rules, analysing findings, and managing remediation workflows.
- Ability to align cloud security initiatives with the overall security program and compliance requirements.
Description
Background Information
The purpose of this request is to procure a contingent cybersecurity resource in a
Security Specialist – Intermediate capacity to support the Cyber Security Defence Operations team with hands-on operational initiatives for Ontario Health (OH).
This Role Will Focus On Two Primary Areas
- Continuous Threat Exposure Management (CTEM)
Leading the design and operationalization of a CTEM program that provides continuous visibility into the organization’s cyber exposure. This includes threat exposure analysis, attack path analysis, validation of remediation through testing, and risk-based prioritization to ensure critical issues are addressed first.
The resource will strengthen coordination between CTEM, SOC, and vulnerability management workflows, ensuring that exposure findings translate into actionable improvements in monitoring, detection, and response.
Demonstrated hands-on experience using Security Copilot and security automation agents to support CTEM execution is required. This includes AI-assisted threat analysis, correlation of exposure data, attack path analysis, and validation of exploitability.
- DevSecOps Pipeline Security & Cloud Security Posture Management
Implementing and enhancing DevSecOps practices by embedding security into the software development lifecycle (SDLC) and CI/CD pipelines.
The resource will lead the integration of security testing tools, including SAST, DAST, Software Composition Analysis (SCA), container scanning, and Infrastructure-as-Code scanning, into automated build processes. This will ensure vulnerabilities are identified and addressed as early as possible through a “shift-left” approach.
In parallel, the role will oversee cloud security posture management (CSPM) and cloud-native application protection platform (CNAPP) operations across OH’s AWS and Azure environments to continuously monitor and remediate cloud security risks.
This involves implementing a CSPM/CNAPP solution to identify misconfigurations, insecure practices, and runtime threats, and working with cloud teams to reduce risk.
This role is explicitly hands-on and operational. It requires a strong technical background in cyber defence operations and the ability to execute and deliver tangible outcomes in the areas described above. The resource will be expected to work across teams, including SOC, DevOps, and cloud engineering, to implement and execute solutions rather than only providing recommendations.
Responsibilities
- CTEM & Exposure Management
Operate and Mature Day-to-Day CTEM Activities
- Execute continuous, day-to-day threat and exposure analysis as part of regular CTEM operations.
- Conduct daily review and analysis of attack surface risk using Microsoft Defender, Tenable, Prisma Cloud, and native Azure and AWS security services to identify vulnerabilities, misconfigurations, identity risks, and externally exposed assets requiring immediate attention.
- Perform day-to-day threat analysis leveraging multiple threat intelligence sources, vulnerability disclosures, emerging cyber threat trends, and security advisories to assess organizational impact and drive risk-based response and remediation activities.
Risk-Based Prioritization & Remediation
- Implement mechanisms to assess and score exposures based on exploitability, potential impact, and relevant threat intelligence.
- Develop risk-based remediation plans and work with IT and application teams to ensure that critical exposures are remediated promptly.
- Provide clear communication of risk rankings and recommended actions to stakeholders.
- DevSecOps & Cloud Security Operations
DevSecOps Pipeline Integration
- Collaborate with software development and DevOps teams to embed security testing into CI/CD pipelines.
- Implement and tune SAST, DAST, SCA, and Infrastructure-as-Code scanning tools so that code, dependencies, and cloud templates are scanned for vulnerabilities with each build or release.
- Ensure that these processes are automated and produce actionable results for developers, with minimal false positives.
Secure Coding & Remediation Support
- Provide guidance and best practices to development teams on resolving vulnerabilities identified through pipeline scans.
Cloud Security Posture Management
- Take ownership of monitoring and improving the security posture of OH’s AWS and Azure environments.
- Regularly review cloud configurations and identify misconfigurations or compliance gaps, such as open storage buckets, overly permissive roles, and unpatched workloads.
- Configure and operate a CSPM/CNAPP tool to continuously detect, categorize, and report cloud security issues.
Cloud Risk Remediation & Integration
- Work with cloud engineering and operations teams to remediate identified cloud risks.
Desired Skills
- Experience in healthcare or public sector environments, particularly the Ontario health sector.
- Prior exposure to or participation in threat intelligence and threat hunting activities.
- Knowledge of modern containerization and cloud-native application development practices, including Kubernetes security and microservices architecture, is an advantage.
- Relevant certifications, such as CISSP, CISM, GIAC, or Azure Security Engineer.
Required Skills
- Minimum 5–8 years of experience in cybersecurity, with extensive exposure to security operations and vulnerability management or DevSecOps programs.
- Proven experience developing and executing a Continuous Threat Exposure Management or advanced vulnerability management program, such as CTEM, including continuous discovery of exposures, threat scenario analysis, attack-path mapping, and risk-based prioritization of remediation actions.
- Deep DevSecOps experience, with hands-on implementation of secure CI/CD pipeline practices, integrating SAST, DAST, SCA, IaC security scanning, and container security scans in collaboration with development and DevOps teams.
- Strong cloud security expertise across AWS and Azure, including practical knowledge of cloud-native security controls such as IAM, network security groups, logging and monitoring, encryption, and cloud threat detection services such as AWS GuardDuty and Azure Defender/Sentinel.
- In-depth experience operating a Cloud Security Posture Management (CSPM) or CNAPP solution, such as Prisma Cloud or a similar platform, to continually assess and improve cloud posture.
- Excellent written and verbal communication skills, with the ability to produce clear technical documentation, reports, and executive-level summaries.
Strong Expertise In
- Continuous Threat Exposure Management and Vulnerability Management
- Hands-on experience running programs that continuously identify and mitigate security exposures, aligning closely with organizational risk tolerance.
- DevSecOps and Secure SDLC
- Proven ability to implement and manage security controls within CI/CD pipelines.
- Ability to work with DevOps tools and processes, including source control, CI servers, container platforms, and related technologies, to improve software security.
- Cloud Security (AWS & Azure)
- In-depth hands-on knowledge of securing cloud environments, including identity management, network security, monitoring through CloudTrail, CloudWatch, and Azure Monitor, and secure configuration of cloud services.
- CSPM/CNAPP Solutions
- Operational experience with cloud security posture management platforms.
- Ability to configure and tune these tools to an organization’s environment and policies.
Demonstrated Ability To
- Design and implement complex security solutions and processes, ensuring they are effectively integrated into everyday operations. Examples include implementing CTEM processes and ensuring follow-through, as well as integrating new security tools so they are used consistently by teams.
- Perform risk-based analysis and prioritization, evaluating where to focus security resources for maximum impact and articulating the rationale to stakeholders.
- Collaborate across multidisciplinary teams, including security, IT, DevOps, cloud, and business teams, to drive security initiatives, overcome silos, and align efforts with organizational objectives.
- Communicate complex security issues and solutions clearly, adjusting the level of detail for technical teams versus leadership or non-technical stakeholders.
Solid Understanding Of
- The modern cyber threat landscape and attack vectors.
- Security architecture principles in both on-premises and cloud environments.
Core Competencies
- Strong focus on execution, delivery, and measurable outcomes: Demonstrate a commitment to delivering tangible security improvements.
- Strong analytical and problem-solving skills: Ability to dissect complex security problems, identify root causes, and develop creative solutions.
- Execution and delivery focus: Demonstrate a bias toward action and results by setting clear goals, meeting deadlines, and delivering high-quality outputs that measurably improve security posture.
- Adaptability and continuous learning: Stay current with emerging threats, new security technologies, and best practices, and quickly adjust approaches as the environment evolves.
- Teamwork and mentorship: Work effectively within team settings, share knowledge, and help upskill internal team members throughout the engagement.
Deliverables
DevSecOps Findings & Metrics
- Deliver periodic summaries of vulnerabilities detected in pipelines, highlighting trends, such as common weakness types in code or configurations, and improvements over time as DevSecOps practices mature.
- Use these metrics to demonstrate progress, such as a reduction in average vulnerabilities per build, and to inform further training or tool tuning.
Secure Development Standards & Training Materials
- Develop or update secure coding and DevSecOps best-practice documents tailored to OH’s development environment.
- This may include guidelines for secure coding, secure use of open-source libraries, and secure container configuration.
- If needed, conduct workshops or knowledge-sharing sessions, with training slides or quick reference materials provided as deliverables, to educate developers on these standards.
- Cloud Security Posture Management (CSPM) & Cloud Defence
Cloud Security Assessment & Gap Analysis
- Conduct an initial end-to-end cloud security posture assessment of OH’s AWS and Azure environments.
- Produce a report of findings detailing misconfigurations, compliance issues, and risk areas, such as unsecured interfaces and improper access settings, along with severity ratings.
- This assessment will serve as a baseline for improvement.
CSPM/CNAPP Implementation
- Fully deploy and configure the CSPM/CNAPP platform for multi-cloud coverage.
- Deliver a configuration summary and operations guide for the platform, including configured policies, alert thresholds, and integration points, such as ticketing or notification systems.
- Ensure that the platform is configured to provide actionable alerts to the appropriate teams.
Remediation Playbooks
- For common or critical cloud findings, such as an S3 bucket made public or unencrypted database instances, develop remediation playbooks or runbooks.
- These should outline the steps for remediation and include any automation scripts, if available, enabling faster response when similar issues are detected in the future.
- Additional Deliverables
Deliverables are not limited to the above and may evolve based on organizational priorities, emerging threats, or changes in the security environment during the engagement.
The resource is expected to adapt to changing requirements and contribute broadly to the overall security program maturity and operational resilience as needed.
How to Apply
If you are interested and your profile matches the requirements, kindly send the following mandatory documents to
hrsmss@smsoftconsulting.com by
Monday, October 26, 2026, at 11:30 AM EST.
Mandatory Documents
- Updated Resume in Word format (Mandatory)
- Skills Matrix and References (Mandatory)
- Expected Hourly Rate (Mandatory)
- Visa Status (Mandatory)
- LinkedIn ID (Mandatory)
Without the mandatory documents, we cannot submit a candidate.
For daily job updates, you can also join our WhatsApp group using the link below:
WhatsApp Group: Join our WhatsApp Group
Additional Information and Contract Notes
Engagement Term
The term of this Engagement Assignment is
175 Business Days, with an option to extend for
250 business days at the Agency’s discretion. The Engagement Assignment may also be extended for unused Business Days at the Agency’s discretion.
The resource will comply with Agency policies and procedures.
Note
- Assignment Type: This position is currently Hybrid.
- Onsite Requirement: The resource will be required to work onsite as per the Hiring Manager’s sole discretion.
- Location: Up to 3 days onsite, subject to the Hiring Manager’s discretion.
- Public Sector Experience: Nice to Have.
Email is the best way to reach us.
You have received this message either as a result of contacting our company to express interest in employment or as a result of posting your resume in a location that can be accessed by recruiters or HR specialists, which suggests an interest in being contacted about employment opportunities.
