Security director at Intact, an insurer, protecting customer and broker digital channels and third - party risk platforms. Leading technical teams, governance, strategy, and security operations.
About the role
- DevSecOps Specialist leading Secure-SDLC initiatives and application security projects at Marsh. Collaborating with teams to enhance security practices and tool integrations.
Responsibilities
- Lead initiatives related to DevSecOps and Secure-SDLC.
- Enhance the company’s Secure Software development Lifecycle (Secure-SDLC) which in turn will reflect the company’s Application Development Security Policy,
- Select and standardize application security tools. This includes vendor/tool assessments and full POC,
- Integrate Secure-SDLC requirements and other security policy/requirements into the DevSecOps processes,
- Define and enhance application security requirements and standards which must be designed for agile development methods leveraging traditional application architectures as well as cloud architectures and container workloads.
- Advise the application security leadership on best practices and standards around application security tools with main focus on shift-left, create predictable CI/CD pipeline processes, and enable application teams to develop new capabilities securely, and free from security defects, by design
- Assess security tools and related processes currently used within the various Software Development Life Cycle processes to identify improvements opportunities, and rationalize the tools set
- Select new application security tools including vendor/tool assessments and conduct full POC to prove that the security solutions/products are fit-for-purpose and fit-for-use
- Draft documentation for the Secure-SDLC and DevSecOps to illustrate the frameworks and its process guidelines to internal customers ensuring the style is palatable and easy to navigate
- Assess impact of new publications from the security industry (e.g. NIST 800-XXX, ISO 2700X:2022, etc) on the company’s AppSec programs
- Research new trends and advise the application security leaderships on impact of the new trends as they relate to currently used tools, tool chain roadmap, efficiency and effectiveness of current processes, etc.
- Promote secure coding standard and all related processes
- Promote the priorities set forth by Global Information Security function, and the roadmap set forth by the Global Application Security
- Automate and integrate security scan and analysis tools into the DevSecOps pipeline
Requirements
- 5 years+ DevSecOps and Secure-SDLC work experience
- CISSP, CSSLP, cloud security, DevSecOps automation, or similar is required
- Post-secondary education or equivalent experience as a DevSecOps Engineer
- Develop/enhance and implement the Secure-SDLC framework
- Design, implement, and rollout DevSecOps automations and tool chain
- Implement sensors to collect data on key metrics for statistics and reporting
- Serve as the subject matter expert in Secure-SDLC and DevSecOps
- Advise on the processes and standards that are designed to implement a company’s Application Development Security Policy
- Experience in designing Secure-SDLC processes and relevant tooling to support the processes
- Experience in software/application analysis tools like SAST, DAST, SCA, threat modeling, supply-chain etc.
- Technical hands-on experience in automating and integrating security scan and analysis tools into the DevSecOps pipeline.
- Experience in one or more programming languages
- Familiarity with security frameworks (OWASP Top 10, SANS Top 25, CWE)
Benefits
- health and welfare benefits
- tuition assistance
- retirement programs
- employee assistance programs
Job title
Job type
Experience level
Salary
Degree requirement
Tech skills
Location requirements
Report this job
Found something wrong with the page? Please let us know by submitting a report below.
Senior Security Advisor strengthening Intact Insurance’s cyber - defense detection engineering. Building cloud security, threat detection, and scalable security solutions.
Information Security Advisor conducting cyber - risk assessments and contract reviews for Sun Life, a global financial - services company. Advising business and technology teams on security controls, compliance, and risk remediation.
Enterprise Security Architect securing technology for Vancity, a member - owned Canadian credit union. Designing enterprise application security frameworks, controls, and risk - based cybersecurity solutions.
Director leading IT and cybersecurity operations for the Azrieli Foundation, a Canadian philanthropic organization. Assessing technology risks, overseeing infrastructure, vendors, incident response and executive technology strategy.
Data Security Specialist protecting Sun Life’s financial - services data through DLP, CASB and insider - threat programs. Investigating cyber risks and advancing enterprise data protection.
Senior security advisor strengthening Desjardins's cooperative financial security posture. Leading strategic security initiatives, governance, policies and complex organization - wide projects.
Senior SaaS Security Manager protecting RBC’s banking platform from third - party cloud risks. Leading controls, vulnerability management, compliance, and security transformation initiatives.
Développeur.euse sécurité cloud protégeant l’infrastructure de nesto, plateforme de financement hypothécaire canadienne. Conception de contrôles cloud, automatisation DevSecOps et réponse aux incidents.
Lead SCADA and cybersecurity engineer designing compliant electric - substation systems for GE Vernova. Coordinating multidisciplinary teams, vendors, testing, estimates, and project risk for decarbonized energy infrastructure.