Cloud Computing Specialist (Cybersecurity Advisor)

COFOMO; Montreal; Hybrid; CAD 110,000 - 150,000; Full time

Job summary

COFOMO, a leading Canadian consulting firm, seeks a Cloud Computing Specialist (Cybersecurity Advisor) in Montreal. Hybrid work arrangement, focusing on cloud security architecture, risk assessment, and identity management.

You will drive security controls across IAM, encryption, logging, and threat modeling for cloud environments. The role demands extensive hands-on experience in information security with cloud specialization, strong knowledge of Azure and AWS, and experience with CSPM, CWP,

Qualifications

• At least 10 years in information security with cloud specialization.
• Strong knowledge of Microsoft Azure and AWS; GCP knowledge is a plus.
• Master IAM, privileged access, networking, data protection, encryption, key/secrets, logging and monitoring.

Responsibilities

• Provide cloud security expertise during solution design, architecture reviews, project delivery and tech change initiatives.
• Evaluate cloud architectures against security requirements and risk appetite.
• Recommend security controls for IAM, networking, data protection, encryption, and logging.
• Support threat modeling and cloud risk assessments; translate risks into enforceable controls.
• Document security recommendations, residual risks, and corrective actions.
• Promote security-by-design and least privilege for cloud solutions; improve CSPM and workload protection.
• Review cloud configurations, security findings, and deviations from baselines; verify control effectiveness.
• Lead vulnerability management and remediation of cloud workloads and platforms.
• Define cloud security logging, alerting, and telemetry requirements; improve detection coverage.
• Communicate risks and recommendations to stakeholders and risk managers.

Skills

Cloud security

IAM

Threat modeling

Vulnerability management

Kubernetes

Encryption & key management

Logging & monitoring

Security architecture

Tools

Terraform

CloudFormation

Kubernetes

CI/CD pipelines

Cloud security tools

Job description

87610# Cloud Computing Specialist (Cybersecurity Advisor)MontrealHybridCybersecurity and Identity ManagementApplyWith over 30 years of recognized expertise, COFOMO is now a leading Canadian consulting firm specializing in digital and artificial intelligence. Supported by more than 3,000 experts, 10 Centers of Excellence, and 4 offices across the country, we are uniquely positioned to successfully guide our clients through their transformations. Both strategic and tactical, we help organizations across a wide range of industries thrive in today’s rapidly evolving world.## Our promiseHelp our clients succeed and maximize the impact of their transformation initiatives, turning them into powerful drivers of growth and innovation.## Job description**Here's a brief overview of the tasks and responsibilities you'll have :** • Provide cloud security expertise during solution design, architecture reviews, project delivery, and technology change initiatives; • Evaluate cloud architectures and services based on security requirements, approved models, and risk appetite; • Recommend appropriate security controls for identity and access management, networking, data protection, encryption, key and secret management, logging, monitoring, backups, and resiliency; • Support threat modeling and cloud risk assessments by translating identified risks into accurate and enforceable security controls; • Document security recommendations and decisions, residual risks, exceptions, and required corrective actions; • Promote security-by-design and least privilege principles for cloud solutions and services; • Contribute to the implementation and continuous improvement of cloud security posture management and workload protection capabilities; • Review cloud configurations, security findings, proofs of control, and deviations from approved baselines; • Validate the effectiveness of preventive, detective, and remedial controls and identify misconfigurations, excessive permissions, exposed services, and inadequate security settings; • Work with environment owners to prioritize corrective actions based on risk exposure, operability, business impact, root causes, and compensating controls; • Develop and maintain relevant metrics on cloud security posture, control coverage, exceptions, and remediation progress; • Assess identity and access management controls, including privileged access, service and workload identities, role assignments, and segregation of duties; • Advise teams on secure authentication, authorization, conditional access, federation and privileged access management mechanisms; • Support requirements for data classification and protection, encryption, key and certificate lifecycle, protection of secrets, and secure data retention and transfer; • Review network segmentation, connectivity, inbound and outbound flow controls, resource exposure to unauthorized external networks, and secure administrative access mechanisms; • Guide teams on securing virtual machines, managed services, databases, storage, serverless services, containers, Kubernetes, and integration platforms; • Integrate security requirements into Infrastructure as Code (IaC) practices and continuous integration and continuous deployment (CI/CD) pipelines, in collaboration with relevant teams; • Automate the validation of configurations, policies, and secrets to detect security deviations before deployment; • Contribute to the implementation of repeatable safeguards, Policy as Code controls, secure templates, and security controls built into deployment processes; • Analyze findings from infrastructure and vulnerability analysis tools, cloud security services, and code security tools; • Reduce reliance on manual controls and configuration creep through automated, repeatable security practices; • Verify security controls for containerized and Kubernetes workloads, including node access, identities, group and namespace isolation, network policies, image integrity, secrets, admission controls, and runtime protection; • Define and maintain secure baselines for containers, registries, platforms, and cloud workloads; • Lead vulnerability management and remediation of managed platform workloads, images, hosts, and components; • Define cloud security logging, alerting, monitoring, and telemetry requirements; • Improve detection coverage and operational efficiency of security alerts in collaboration with relevant stakeholders; • Participate in vulnerability assessments, investigations, and incidents by validating findings, assessing their severity, analyzing root causes, and recommending corrective controls; • Integrate lessons learned from findings and incidents into standards, baselines, guardrails, and future solution reviews; • Support risk and control assessments, audits, and evidence reviews of compliance in cloud security; • Interpret security policies, standards, frameworks and regulatory requirements in the context of cloud services and delivery models; • Contribute to the development and maintenance of standards, guidelines, control objectives and reference models in cloud security; • Review waiver and exception requests, document risks and compensating controls, and follow up on remediation commitments; • Clearly communicate security risks and recommendations to technical stakeholders, risk managers, and management. **The profile we are looking for is as follows:** • Have at least 10 years of hands-on experience in information security, with a specialization in cloud security, cloud architecture, or cloud operations; • Have an excellent knowledge of the architecture and security of Microsoft Azure and Amazon Web Services (AWS); • Knowledge of Google Cloud Platform (GCP) security (an asset); • Master cloud identity and access management (IAM), privileged access management, networking, data protection, encryption, key and secret management, and logging, monitoring, and resiliency; • Experience evaluating cloud-native services, hybrid environments, containers, Kubernetes, and platform services; • Understand security concepts related to Infrastructure as Code (IaC) and the Shift Left approach in CI/CD pipelines, including Terraform, CloudFormation, Policy as Code, security controls, and automated configuration validation; • Demonstrate experience with Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), vulnerability management, secure configuration assessment, and remediation follow-up solutions; • Possess a good knowledge of security architecture, security controls, threat modeling, risk assessment, and secure design patterns; • Knowledge of recognized practices and frameworks, including CIS Benchmarks, NIST Cybersecurity Framework, NIST SP 800-53, NIST SP 800-190, CSA Cloud Controls Matrix, and OWASP recommendations; • Demonstrate the ability to analyze security findings, distinguish significant risks from low-value items or false positives, and recommend controls commensurate with the level of risk; • Have a working knowledge of scripting or query languages used for security log analysis and automation (an asset).Apply