Senior Security Specialist protecting BDO Canada’s enterprise systems through threat detection, incident response, and vulnerability management. Supporting security operations across blended office, client - site, and virtual environments.
IS
Cybersecurity Lead – Security Engineering, Compliance Lead
Posted 1 hour ago
About the role
- Cybersecurity Lead strengthening Irth’s SaaS security program for utility infrastructure operators. Owning vulnerability management, incident response, cloud security, compliance, and customer trust.
Responsibilities
- Own the triage and prioritization of security findings from SAST tools, infrastructure security assessments, penetration tests, and newly disclosed CVEs.
- Assess risk and severity, establish remediation priorities, and assign ownership and deadlines.
- Partner with engineering and infrastructure teams to resolve vulnerabilities through patching, configuration changes, dependency upgrades, and resource decommissioning.
- Integrate security findings into engineering work management systems and track owners, tickets, and target remediation dates.
- Report remediation progress, outstanding risks, and security trends to IT, engineering, and executive leadership.
- Provide vulnerability and remediation updates to customers.
- Lead security incident response from detection and investigation through containment, remediation, and post-incident review.
- Coordinate urgent vulnerability and CVE responses across technical teams.
- Establish incident communications, including internal status updates, executive briefings, and Customer Experience talking points.
- Prepare customer-facing communications regarding potential exposure, remediation status, and detection activities.
- Maintain incident response runbooks and on-call escalation procedures.
- Conduct regular incident response tabletop exercises.
- Own cloud security posture across AWS and Microsoft Azure, including account structure, security guardrails, and continuous monitoring.
- Establish and enforce identity and access management policies.
- Manage identity controls across Microsoft Entra ID and AWS IAM.
- Conduct access reviews for employees, contractors, and third-party vendors.
- Identify and remediate excessive permissions, inactive accounts, and access control gaps.
- Develop, maintain, and enforce corporate security policies, standards, and procedures aligned with NIST CSF and ISO 27001.
- Own technical security controls supporting SOC 2 Type II and ISO 27001 compliance.
- Partner with GRC on audit readiness, evidence collection, and remediation of control gaps.
- Monitor regulatory and industry requirements affecting critical-infrastructure customers.
- Translate regulatory and customer requirements into practical technical security controls.
- Lead technical responses to customer security questionnaires.
- Represent Irth's cybersecurity program during customer security reviews and calls.
- Manage third-party penetration testing engagements and security vendors.
- Support cybersecurity due diligence for acquisitions.
- Drive security findings through resolution, establish accountability and measurable remediation timelines, and communicate security issues to technical and nontechnical audiences.
Requirements
- 8+ years of experience in cybersecurity engineering or security operations, including at least 3 years leading a security program or function, preferably within a SaaS organization.
- Hands-on cloud security experience across AWS and Microsoft Azure, including Identity and Access Management (IAM), cloud network security controls, security logging, monitoring, and audit trails, AWS CloudTrail, Microsoft Entra sign-in and audit logs, and cloud security posture management tools such as Wiz.
- Demonstrated experience owning vulnerability management end to end, including identifying, triaging, prioritizing, assigning, tracking, and driving remediation in partnership with engineering teams.
- Proven experience leading security incident response, including delivering clear, timely written communications to executive leadership and customers during high-pressure situations.
- Working knowledge of SOC 2 Type II, ISO 27001, and NIST Cybersecurity Framework (CSF), including experience serving as a key technical control owner through at least one SOC 2 Type II audit.
- Ability to review and interpret application code, infrastructure-as-code (IaC), and Linux and Windows server configurations to evaluate security risks and validate remediation approaches.
- Strong written and verbal communication skills, sound technical judgment, and the ability to distinguish between issues requiring immediate escalation and those that can be resolved through routine remediation.
- Experience supporting utilities, pipelines, energy providers, or other critical-infrastructure customers, including familiarity with TSA pipeline security directives or NERC CIP requirements.
- Familiarity with Canadian privacy requirements, including Quebec's Law 25.
- Experience securing AI-enabled and agent-based development workflows or implementing security controls for LLM-powered SaaS product features.
- Experience conducting cybersecurity due diligence or supporting security integration activities related to mergers and acquisitions.
- Relevant industry certifications, such as Certified Information Systems …
Benefits
- Join a dynamic, growing company with a strong reputation in its industry.
- Competitive salary.
- Comprehensive health plan options, including medical, dental, and vision coverage.
- 401(k) plan with company match.
- Flexible PTO policy plus company-paid holidays.
- Additional benefits, including life insurance, pet insurance, and employee discounts and perks programs.
- Generous one-time work-from-home stipend to help you set up your home workspace.
- Company events and opportunities to connect, including monthly team lunches, volunteer outings, and quarterly gatherings.
- Hybrid employees have access to complimentary snacks, beverages, and coffee at our Columbus, Ohio office.
Job title
Job type
Experience level
Salary
Degree requirement
No Education Requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
AI Security Architect defining secure AI architectures, governance, and risk frameworks. Levio delivers digital transformation and large - scale technology projects for clients.
FTTH security expert auditing PON, CPE, and telecom infrastructure for P1 Security. Producing penetration - test reports and remediation guidance for critical network security.
Lead security for Duetto's hotel revenue management platform across AWS, DevSecOps, compliance, incident response, and enterprise customer trust. Own the security posture for a global hospitality technology business.
Senior CyberArk engineer strengthening Manulife’s enterprise privileged - access security platform. Automating PAM operations, integrations, resilience, and production support.
Security Engineer building IAM, PAM, and IGA capabilities for Marqeta’s cloud - based embedded finance platform. Automating access controls across AWS, SaaS, DevOps, and AI/ML systems.
Senior Security Engineer securing gaiia’s cloud - based telecom operating system. Protecting applications, infrastructure, customer data, and compliance programs across a serverless TypeScript platform.
Cloud security leader supporting ServiceNow’s AI - native SaaS security and Canadian enterprise customers. Leading customer security engagements, incident investigations, and cloud security improvements.
Senior Consultant leading cyber regulatory remediation for banks, broker - dealers, and insurers. Driving incident response, vulnerability, patch, and IAM workstreams to closure.
Cyber Security Specialist protecting Scarborough Health Network hospitals and healthcare infrastructure. Managing security systems, assessments, vulnerabilities, incidents, and compliance across the Central East Region.