Senior Information Security Analyst

As Senior Information Security Analyst at D2L, you are a key influencer and contributor to the refinement and delivery of D2L's Information Security Program.

How will I make an Impact?

• Assist in refining and delivering D2L's Information Security Program with particular focus on endpoints, applications, and the underlying infrastructure.
• Perform regular application/infrastructure security scans, generate reports, and liaise with related stakeholders to work towards closing open issues.
• Liaise with operational teams on existing and emerging information security risks and provide subject matter expertise.
• Monitor/track information security risks and related artifacts throughout their lifecycle.
• Support the Information Security Continuous Monitoring Program(s) aligned with specific security compliance programs.
• Support the product sales cycle by completing security questionnaires from prospective clients.
• Collaborate with internal subject matter experts to collate, review, and submit periodic security questionnaires from D2L’s client.
• Support internal D2L teams during security assessments/reviews/audits.
• Review independent third-party reports from vendors, suppliers and partners for adequacy and alignment with D2L’s Information Security Program.
• Track identified gaps from third party assessments and follow up with stakeholders to close outstanding issues.

What you’ll bring to the role:

Competencies:

• Ability to think critically
• Ability to engage process owners and explain security controls associated with processes
• Ability to breakdown complex technical concepts to simple terms for various levels of stakeholders
• Ability to achieve outcomes with minimal supervision.
• Ability to learn fast and synthesize information from different domains and sources.
• Ability to work well with teams within a matrix structure and operational setting

Skills

• Sound knowledge of Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA).
• Sound knowledge of public cloud infrastructure
• Practical knowledge of implementing security controls in public cloud deployments/workloads
• Practical knowledge of Governance Risk and Compliance (GRC) tools
• Practical knowledge of infrastructure and application security scanning tools
• Deep understanding of vulnerability management and penetration testing
• Acumen with Artificial Intelligence tools
• Sound knowledge of risk management framework and standards
• Sound knowledge of Information Security frameworks and standards including ISO 27001, NIST 800-53 etc.

Suggested Qualifications/Experience:

• You have previous hands-on experience implementing information security controls across a wide range of domains including Endpoint Security, Application Security, and Infrastructure Security.
• You have hands-on experience with public cloud services like Amazon Web Services (AWS), Azure etc.
• You have hands-on experience performing vulnerability assessments and penetration tests.
• You have demonstrable experience working with teams that have implemented security controls based on ISO 27001/NIST 800-53, CSAE 3416/SSAE18, SOC1/2/3.
• You have experience using enterprise-grade governance risk and compliance (GRC) tools.
• You have experience assessing security control implementations on large enterprise, web scale and serverless environments.
• You have experience engaging stakeholder in remediating security-related findings
• You have experience supporting an audit exercise by generating security-related evidence

This position is to fill an existing vacancy

D2L operates in a hybrid work style, with expectation of 3 days per week in office.