Application Security Analyst

Randstad Digital; Toronto; Hybrid; CAD 95,000 - 100,000; Full time

Job summary

Randstad Digital in Canada is seeking an Information Security Analyst to protect corporate assets by overseeing security policies and SDLC security. You will contribute to risk mitigation across shared services and support vulnerability assessments, third-party SaaS reviews, and disaster recovery activities.

You will ensure secure coding, perform vulnerability scans, review application controls, and participate in external security reviews of vendors.

Qualifications

• 2–3 years of experience in information security, financial services preferred.
• Bachelor’s degree in Information Technology, Computer Science, or a related discipline (or equivalent practical experience).
• Knowledge of vulnerability assessments, secure code and infrastructure reviews, secure access modeling, threat modeling, and digital security architecture.
• Solid understanding of cloud security (AWS, Azure) and audit standards like PCI-DSS, SSAE-16, FFIEC.
• Exceptional interpersonal, collaboration, written, presentation, and multi-tasking skills for cross-functional stakeholders.

Responsibilities

• Ensure the SDLC complies with information security policies for secure coding and access controls.
• Perform vulnerability analysis and issues management for pre-production and production applications using standard tools.
• Review proposed changes to application controls including data encryption, user security profiles, and input/output integrity checks.
• Conduct External Security Reviews on third-party vendors and SaaS providers accessing confidential data or performing critical functions.
• Assess cloud vendors and SaaS platforms from an information security requirements perspective.
• Monitor Data Loss Prevention tools, conduct security investigations, and assist with Security Training & Awareness initiatives.
• Support Disaster Recovery operations, including DR tests and DR team assistance.

Skills

Vulnerability assessments

Secure code reviews

Threat modeling

Information security governance

Data loss prevention

Disaster recovery coordination

Education

Bachelor’s degree in IT/CS or related field

Tools

Fortify

Veracode

Checkmarx

AppScan

ServiceNow

Job description

Our client is a leading Canadian financial services organization that has been helping investors build better financial futures for over 35 years. Offering individuals and institutions a comprehensive suite of trusted investment portfolios and services, they boldly embrace innovation across all business areas. Working here means joining a diverse, dedicated, and inclusive team where employees feel valued and supported to achieve their personal and professional best.

Role Overview

This Information Security Analyst position plays a vital role in protecting corporate information assets by providing technical oversight and supporting security policies and procedures. As part of an initiative to standardize security processes across shared services, this role directly supports risk mitigation across the organization. In your first 6 to 12 months, you will make an immediate impact by ensuring software development life cycle (SDLC) security compliance, performing vulnerability assessments, conducting third-party SaaS vendor reviews, and supporting disaster recovery operations.

Main Responsibilities

• Ensure that the software development life cycle complies with information security policies regarding secure coding and secure access controls.
• Perform vulnerability analysis and issues management for pre-production and production applications using standard vulnerability scanning tools.
• Review and challenge proposed changes to application controls, including data encryption, user security profiles/bands, and input/output integrity checks (edit checks, control totals, data validation).
• Conduct External Security Reviews on third-party vendors and SaaS providers accessing confidential data or performing critical business functions.
• Assess cloud vendors and SaaS platforms from an information security requirements perspective.
• Monitor Data Loss Prevention (DLP) tools, conduct security investigations, and assist with Security Training & Awareness initiatives.
• Support Disaster Recovery (DR) operations, including participating in scheduled DR tests and assisting the DR team.

Must-have required skills and experience

• Experience & Industry: 2 to 3 years of relevant experience, with a strong preference for a financial services background.
• Education: Bachelor’s degree in Information Technology, Computer Science, or a related discipline (or equivalent practical experience).
• Technical Domain Knowledge: Knowledge of vulnerability assessments, secure code and infrastructure reviews, secure access modeling, threat modeling, and digital security architecture.
• Cloud & Audit Standards: Solid understanding of cloud security capabilities (AWS, Azure) and industry audit standards, including PCI-DSS, SSAE-16, and FFIEC.
• Soft Skills: Exceptional interpersonal, collaboration, written, presentation, and multi-tasking skills to work effectively with cross-functional technical and business stakeholders.

Nice-to-have skills

• Experience with enterprise scanning and workflow platforms such as Fortify, Veracode, Checkmarx, AppScan, or ServiceNow.
• Professional certifications such as CISSP or Cloud Security certifications.

Logistics & Compensation

• Location/Work Mode: Hybrid arrangement — 2 flexible days per week in-office. The position is based in Toronto until late 2026, transitioning to Mississauga.
• Compensation: Base salary of $95,000 to $100,000 + 15% performance bonus