Information Technology Security Analyst

Location: Remote (Canada)
Employment Type: Contract, 12 months
Only candidates legally eligible to work in Canada without the need for visa sponsorship will be contacted.

About the Role
We are looking for an experienced Application Security Analyst to support enterprise security assessments across applications, SaaS platforms, cloud environments, and emerging AI technologies.
The ideal candidate combines hands-on application security knowledge with strong cybersecurity risk assessment capabilities. This individual will evaluate technical vulnerabilities, assess security controls, identify business risks, and communicate practical remediation recommendations to technical and business stakeholders.
Key Responsibilities
Conduct application security assessments of web applications, APIs, enterprise applications, and cloud-based solutions.
Identify, validate, and assess application vulnerabilities using industry-standard testing methodologies and tools.
Evaluate application security controls, including authentication, authorization, encryption, secure integrations, and data protection.
Review SAST, DAST, SCA, vulnerability assessment, and penetration testing findings; validate risks and recommend remediation.
Apply OWASP Top 10 and OWASP API Security Top 10 principles when assessing application security.
Conduct security architecture reviews, secure design assessments, and threat modeling.
Perform cybersecurity risk assessments for SaaS platforms, third-party vendors, and enterprise technology solutions.
Assess emerging AI and LLM-based applications for security risks, including prompt injection, sensitive data exposure, insecure integrations, and access control weaknesses.
Prepare formal security assessment reports documenting findings, severity, business impact, residual risk, and remediation recommendations.
Collaborate with engineering, technology, business, privacy, legal, and risk stakeholders to address identified security gaps.
Manage multiple assessments concurrently while maintaining clear documentation and timely reporting.
Required Qualifications
3+ years of experience in cybersecurity, information security, application security, or security risk assessments.
Demonstrated hands-on experience conducting application security assessments.
Strong understanding of web application and API security, OWASP Top 10, and common application vulnerabilities.
Experience with application security testing methodologies and tools such as Burp Suite, OWASP ZAP, Checkmarx, Fortify, Veracode, Snyk, or similar.
Knowledge of SAST, DAST, SCA, vulnerability management, penetration testing, and secure code review.
Experience conducting cybersecurity risk assessments, security architecture reviews, or threat modeling.
Understanding of SaaS security, third-party risk assessments, cloud security, and enterprise security controls.
Experience assessing AI/ML or Generative AI applications and LLM security risks.
Strong technical documentation, analytical, and stakeholder communication skills.

Nice to Have
Familiarity with OWASP Top 10 for LLM Applications and AI security assessment frameworks.
Experience reviewing SOC 2, ISO 27001, penetration testing reports, CAIQ, or other vendor security evidence.
Knowledge of NIST CSF, NIST 800-53, ISO 27001, and related security frameworks.
Experience preparing Security Assessment Reports (SARs), risk registers, remediation plans, and POA&Ms.

PlanIT is an equal opportunity employer. We celebrate diversity and are committed to creating an inclusive environment for all employees. All employment is decided based on qualifications, merit, and business needs.

Disclosure:
This posting represents an active and genuine vacancy with one of Plan IT’s clients and is not intended for speculative or pipeline recruitment. Plan IT and/or its clients may use AI-assisted tools from time to time to support the screening and evaluation of applications; however, these tools do not replace human judgment or decision-making at any stage of the hiring process.