HiringCafe
📋 External Recruiting Agencies

Astra North (Astra North Infoteck Inc.) is a specialized IT staffing and recruitment process outsourcing (RPO) provider that focuses on supplying talent and managed services to external clients.

This company was flagged and excluded from default search results. Proceed with caution.

Astra North
Posted 1mo ago

Threat Modeler / Security Architect – AI Security, Cloud & DevSecOps

Astra North
astra-north.zohorecruit.caView all open roles
Toronto, Ontario, Canada
HybridFull Time
Responsibilities
  • conducting assessments
  • developing governance
  • enabling teams
Requirements
  • 5+ years experience
  • Development background
  • Expertise in AI/ML security
  • Cloud-native (AWS,GCP)
  • Threat modeling frameworks (CAPEC,ATT&CK,STRIDE)
  • Application security
  • Java/JavaScript
  • IAM (OAuth 2.0,OIDC,JWT)
  • Preferred security certifications
Technical tools mentioned
AWSGCPCAPECATT&CKSTRIDENIST 800-53NIST Cybersecurity Framework (CSF)OWASP ASVSJavaJavaScriptOracleSQLDB2NoSQLOAuth 2.0OIDCJWT

Job description

Threat Modeler / Security Architect – AI Security, Cloud & DevSecOps​

Must Have Technical/Functional Skills

Security Architecture & Threat Modeling

• Threat Modeler and Security Architect with a strong development background.
• Experience in Artificial Intelligence, Machine Learning, and Data Science with expertise in enterprise architecture, AI product security, and digital transformation.
• Strong hands-on experience with cloud-native architectures, including AWS and GCP.
• Experience with secure AI system development, AI governance, and cybersecurity best practices.
• Experience with threat modeling frameworks, attack vectors, and vulnerability analysis, including:
• CAPEC
• ATT&CK
• STRIDE

Application Security & DevSecOps

• Experience with application security controls across:
• Web applications
• APIs
• Mobile applications
• AI systems
• Knowledge of security frameworks and standards, including:
• NIST 800-53
• NIST Cybersecurity Framework (CSF)
• OWASP ASVS
• Experience with Application Security design and DevSecOps practices.
• Full-stack knowledge of application architectures, including:
• Single Page Applications
• REST APIs
• SOAP APIs
• Mobile applications
• Experience with:
• Java
• JavaScript
• Mobile application development

Database, Cloud & Identity Security

• Knowledge of database architectures, including:
• Oracle
• SQL
• DB2
• NoSQL databases
• Experience with cloud security architecture, design, implementation, and operations.
• Exposure to IAM controls, including:
• OAuth 2.0
• OIDC
• JWT
• Strong understanding of cryptography controls:
• Data at rest
• Data in motion

Certifications

• Preferred certifications:
• CISSP
• CISM
• CSSLP
• CISA
• CRISC
• OSCP

Key Responsibilities

Threat Modeling & Security Assessment

• Conduct security risk assessments of applications based on system design and application code implementation.
• Develop and manage security governance processes and procedures for:
• Threat modeling programs
• Application security design
• DevSecOps programs
• Assist in developing threat modeling governance documentation.
• Develop reports for management related to:
• Residual risk
• Non-compliance
• Review security controls with application owners to ensure requirements are implemented.
• Validate security control implementation against scanning tool outputs to support auditability and verification.

Security Governance & Compliance

• Work with information security leadership to develop strategies and plans to enforce threat modeling and address control gaps.
• Monitor and track compliance with application owners to ensure security controls are implemented as planned.
• Assist application teams with security standard exceptions identified through threat modeling.
• Develop and define security metrics and criteria for information security programs.

Secure Design & Engineering Enablement

• Develop, maintain, update, and enhance:
• Secure design patterns
• Secure coding standards
• Threat libraries
• Socialize secure design patterns and secure coding standards with engineering teams.
• Provide threat modeling consultation and guidance to application teams.
• Enable strong developer and customer experience while collaborating with application teams.
• Develop innovative attack techniques to evaluate protective designs and existing mitigations.

Security Strategy & Architecture

• Participate in developing strategies for information security processes and programs.
• Document current and future state security capabilities using industry-leading technologies to improve IT risk management and data protection.
• Provide security awareness and education on industry trends, efforts, and statistics.
• Recommend resource types and skillsets required to address security project and process challenges.
• Support investment decisions through business cases and cost-benefit analysis.

Agile Delivery & Collaboration

• Facilitate Agile events to help teams deliver value incrementally and iteratively.
• Support Program Increment (PI) execution through team-level events and collaboration with Release Train Engineers (RTE).
• Support teams in achieving PI objectives.
• Provide consultation and advice to assess information security risks and implement controls to protect intellectual property and sensitive data.