IT Security Analyst

LanceSoft; Toronto; Hybrid; CAD 85,000 - 120,000; Full time

Job summary

A premier IT consultancy is looking for an experienced Application Security Analyst in Toronto to integrate security into release management processes. Ideal candidates will have over 10 years in IT and experience with SAST, DAST, and other application security practices. This role offers a hybrid work environment and the opportunity to work with a top Canadian bank, contributing to new security products.

Qualifications

• 10+ years of relevant IT experience.
• 3+ years as an application security analyst.
• Experience with SAST, DAST, SCA in SSDLC.

Responsibilities

• Implement application security into Release Management processes.
• Conduct gap analysis for business processes.
• Align AppSec practices with strategic goals.

Skills

Application Security

Risk Assessment

Project Management

Communication Skills

Education

Undergraduate degree or equivalent experience

Tools

BitBucket

Jenkins

Power BI

Python

Job description

Location Address: Hybrid – 44 King Street 10th Floor, Toronto – 2-4 days onsite (Tuesdays and Thursdays subject to change and can be flexible). Subject to change: 3–4 days onsite may be required based on business needs. Contract Duration: 6 months. Possibility of extension & conversion to FTE. Schedule Hours: 9am-5pm Monday-Friday; standard 37.5 hrs/week.

Candidate Value Proposition: The successful candidate will have the opportunity to gain exposure to modern technologies, application and cloud, involved in bringing in new security products to the bank, for a top 5 Canadian Bank.

Typical Day in Role:

• Partner with development, engineering, DevOps, application security and application owner teams to ensure seamless integration of Application Security into Release Management processes.
• Contribute to design and implementation of AppSec gating controls to ensure and compliant application releases.
• Align AppSec release practices with the Bank’s strategic goals of establishing a unified global release management framework across organization.
• Conduct gap analysis, research and analyzing current business processes, identify inefficiencies and recommend improvements aligned with security and operational goals.
• Collaborate with AppSec engineer and stakeholders to gather and document security requirements for applications and systems.
• Facilitate cross-functional collaboration to embed security requirements early in the software development lifecycle.
• Ensure security controls and testing (e.g., SAST, DAST, SCA) are embedded in the CICD pipelines.
• Develop and maintain AppSec release management reporting for CIOs, providing visibility into security posture.
• Lead communication and training initiatives for CIO and development teams, including the creation of training materials and ongoing engagement across all CIO organizations.
• Facilitate effective communication and collaboration between business units and IT teams, ensuring alignment on goals, timelines and deliverables.
• Support the training and rollout of security tools such as SAST, DAST, ensuring smooth transition into existing workflow.
• Analyze business and operational data to uncover risk and opportunities for improvement.

Candidate Requirements/Must Have Skills:

1. 10+ years’ relevant working experience in IT (application security, release management etc.).
2. 3 + years’ experience as an application security analyst, with demonstrated experience in security integration, automation of security processes, risk assessment and mitigation.
3. 2+ years’ experience practicing application security (SAST, DAST, SCA, MAST) throughout the Secure Software Development Lifecycle (SSDLC), with demonstrated experience in vulnerability assessment, security integration, automation of security processes, risk assessment and mitigation.
4. 2+ years’ experience building executive-level reports and dashboard that communicates security posture.
5. 2+ years’ experience designing and delivering training programs (e.g., live sessions, documenting).

Nice-To-Have Skills:

1. 2+ years’ experience with popular CI/CD tools and processes like BitBucket/GitHub, Jfrog Artifactory, Jenkins, Azure DevOps, GitLab CI/CD.
2. Proficiency in tools like Excel, Power BI, or other reporting platforms.
3. Programming and scripting experience (Python preferred).

Soft Skills Required:

• Excellent communication skills and good support skills for triaging and analysis of issues for all development teams.
• Proficient at collaborating with various stakeholders to achieve the objectives assigned.
• Strong project management type of skills – organized, time management, etc.
• Self-sufficient, very meticulous with business analysis skills – gathering, translating, putting together requirements.
• Detail oriented and skilled in summarizing and provides insights from complicated processes.

Education:

Undergrad or equivalent experience – valuing work experience more. CISSP or any security certification is an asset.

Best VS. Average Candidate:

Experience delivering successful projects, candidate who has the technical skills and strong communication skills, someone who is adaptable and keen to learn new skills and technology and is a team player, is open to feedback as a learning opportunity; product knowledge is coachable, strong base for AppSec and ideally programming knowledge but would rather have someone who is strong in comms and eager to learn and can coach on some of the more specific technical pieces.

Candidate Review & Selection

1-2 rounds – remote – Video Conference Call MS Teams. 1st – HM and one or two Senior Leads – 1 hour – technical interview focusing on Application product/solution integration within the SDLC and vulnerability assessment knowledge and skills.