Security Analyst II

CI Investments Inc.; Toronto; On-site; CAD 120,000 - 160,000; Full time

Job summary

CI Investments Inc. is seeking a Senior Security Specialist who will own risk identification, remediation and governance across security engineering, cloud and infrastructure.

You will lead complex detection, response and vulnerability management initiatives while coordinating with cross‑functional teams and vendors. The role requires hands‑on expertise, strong communication with technical and business stakeholders, and the ability to translate risk into practical controls.

Qualifications

• Five or more years of progressive information security experience.
• Leadership of complex investigations or incident response.
• Experience with vulnerability management across enterprise infrastructure.
• Experience with application security testing (SAST/DAST).

Responsibilities

• Lead security engineering, detecting and remediating enterprise risk.
• Coordinate cross‑functional remediation and communicate risk to stakeholders.
• Oversee threat hunting, incident response, and governance activities.
• Develop automation to improve analysis, reporting and response.
• Advise on security requirements across projects and SDLC.

Skills

Security operations

Incident response

Vulnerability management

Application security

Threat hunting

Security governance

Tools

CrowdStrike

ExtraHop

Darktrace

Splunk

Qualys

Tenable

Checkmarx

Veracode

Snyk

Job description

At CI, we see a great place to work as one that is a safe place for everyone to have a voice, where people are empowered to take ownership over meaningful work, where there is an opportunity to grow through stretching themselves, where they can work on innovative products and projects, and where employees are supported and engaged in doing so.

The Security Analyst II (Senior Security Specialist) is a senior hands‑on security professional responsible for identifying, assessing, and remediating enterprise security risk. The role leads complex operational security activities across detection and response, vulnerability management, application security, cloud and infrastructure security, security technology, governance, and advisory services. The incumbent works independently, coordinates cross‑functional remediation, communicates risk to technical and business stakeholders, and contributes to the continuous improvement of CI’s cybersecurity program.

Key Responsibilities

Security Engineering and Technology

• Deploy, integrate, configure and enhance security solutions in accordance with approved architecture, change management and operating procedures.
• Monitor security platforms for appropriate operation, data quality, coverage, performance and control effectiveness.
• Lead technical troubleshooting and coordinate with internal teams and vendors to resolve security technology issues.
• Evaluate security capabilities and recommend enhancements that measurably reduce risk, improve detection or increase operational efficiency.
• Develop scripts, queries, automation or repeatable workflows to improve analysis, reporting and response.

Application and Cloud Security

• Lead application security scanning activities across SAST, DAST, IaC, SAC, API testing and support teams in interpreting findings and selecting remediation approaches.
• Partner with application owners and developers to embed security requirements into delivery processes and resolve material findings.
• Provide security guidance through the system development lifecycle, including architecture design review, threat modelling, secure design and security testing.
• Review cloud applications, configurations, identity controls, data flows and logging to identify security risk and required safeguards.

Security Monitoring, Threat Hunting and Incident Response

• Investigate and triage complex security alerts and suspected compromises; determine scope, impact and required containment actions.
• Lead or coordinate incident response activities, including investigation, containment, eradication, recovery, evidence preservation, documentation and lessons learned.
• Improve detection coverage by identifying telemetry gaps, refining use cases and validating alert effectiveness.
• Perform proactive threat hunting using endpoints, network, identity, cloud and SIEM telemetry to identify advanced or previously undetected threats.
• Analyse threat intelligence and security advisories to determine relevance to CI and recommend defensive actions.
• Participate in the after‑hours on‑call rotation and support high‑severity incidents as required.

Vulnerability and Exposure Management

• Lead infrastructure vulnerability management activities, including scan coverage, validation, prioritisation, exception handling, remediation tracking and reporting.
• Partner with infrastructure, application and platform teams to drive risk‑based remediation of vulnerabilities and security misconfigurations.
• Assess exploitability, asset criticality, threat intelligence and business impact to establish remediation priorities.
• Monitor emerging and actively exploited vulnerabilities, coordinate rapid exposure assessment and recommend compensating controls where immediate remediation is not possible.
• Identify recurring control gaps and recommend sustainable process or technology improvements.

Security Risk Advisory and Governance

• Advise business and technology projects on security requirements, control design, risk treatment and compliance with CI policies and standards.
• Conduct structured security and threat risk assessments; document findings, risk rationale, mitigation recommendations and residual risk.
• Assess new technologies and services for security risk and document clear, actionable requirements.
• Maintain clear risk records and track agreed remediation actions to closure or formally approved acceptance.
• Contribute to security policies, standards, baselines, procedures, playbooks and control documentation.
• Support audits, regulatory reviews, client due diligence and security assessments by providing accurate control evidence and subject‑matter expertise.
• Present security findings and recommendations in language appropriate for technical teams, business leaders and executive stakeholders.
• Recommend risk treatment and control improvements; formal business, risk acceptance and production‑change approvals remain subject to CI governance

Leadership and Collaboration

• Lead defined workstreams and coordinate activities across Security, Infrastructure, Application, Cloud, Architecture, Risk, Privacy, Legal and vendor teams.
• Provide technical guidance, peer review and knowledge transfer to analysts and technology partners.
• Exercise sound judgement, elevate material risk promptly and maintain clear ownership through to resolution.
• Stay current on emerging threats, attack techniques, security technologies, regulatory expectations and industry practices.
• Perform other related duties as assigned.

Qualifications

Experience

• Five or more years of progressive, hands‑on experience in information security, cybersecurity operations, security engineering, risk assessment or a related discipline.
• Demonstrated experience leading complex security investigations or incident response activities.
• Demonstrated experience with vulnerability management and remediation across enterprise infrastructure.
• Experience with application security testing and remediation, including SAST and DAST.
• Experience advising technology or business initiatives on security architecture, controls and risk treatment.
• Experience producing clear security assessments, risk records, technical documentation and executive‑ready communications.

Technical Knowledge

• Security monitoring and incident response using endpoint detection and response, SIEM and network security telemetry; experience with platforms such as CrowdStrike, ExtraHop, Darktrace and Splunk is an asset.
• Vulnerability assessment and remediation using platforms such as Qualys or Tenable.
• Application security SAST,DAST,SCA, IaC and API testing using platforms such as Checkmarx , Veracod, Snyk.
<