search Browse Jobs
Senior Cyber Security EngineerCAAT Pension Plan · Toronto, Ontario, ON, Canada
CAAT Pension Plan logo

CAAT Pension Plan

company page ↗

Senior Cyber Security Engineer

🗓️ Posted 2026-08-28 Toronto, Ontario, ON, Canada Full-time Hybrid ICT
💰 Salary Not shared 📊 Market 10,000 CAD–15,000 CAD/mo

About the Company

CAAT Pension Plan provides workplaces across Canada with lifetime retirement income plans for employees. CAAT Pension Plan provides workplaces with lifetime retirement income plans for employees. We are an industry-leading innovator in helping more Canadian workplaces and their employees participate in a sustainable pension plan. Seen as one of the most successful plans in Canada, CAAT is highly respected for its successful investment program, pension management expertise and strong governance structure. The CAAT Plan is funded at 124% with a funding reserve of 6.7B and 25.4B in assets under management as of January 1, 2026. We have more than 125,000 members in our Plan and more than 800 participating employers, and we're growing What's different about CAAT We are a highly engaged team of passionate and dedicated professionals who believe in our mission to improve the financial security of our members in their retirement. We are committed to our core belief in the power and efficiency of a jointly governed, multi-employer defined benefit pension plan. We offer the pension benefits Canadians want and are more sustainable and efficient than single-employer pension plans. We are award winning We have been recognized as a top employer and recipient of: Greater Toronto's Top Employers 2020, 2021, 2022, 2023, 2024 and 2025; Canada's Most Admired Corporate Cultures 2020, 2021, 2022, and 2023; Kudos' Best Culture Leader 2021, 2022, 2023, and 2024; and Canadian HR Reporter's Best Places to Work 2021 and 2024 and 5-Star Rewards & Recognition 2022 and 2023. Our success is built on shared governance by members and employers, and its collective focus on benefit security, stable contributions, and fair treatment of all members. With our DBplus pension plan design, we make it easy for employees and their employers to be part of a plan that provides secure lifetime pensions. As CAATsters, we have fun together and give back to our community Financial Services Specialties: DBplus, pensionadministration, definedbenefits, retirementsecurity, pensionplan

Responsibilities

  • ● At CAAT, we're passionate about what we do. And it shows
  • ● Here, you'll find a cultural spark in everything we do - from the way we partner with members and employers, to the way we work, collaborate, and grow. It doesn't just feel different at CAAT. It is different. We're one of the fastest-growing pensions in the country for a reason. We challenge the status quo, making a real impact on the hundreds of employers we serve - from education institutions to major corporations and household brands. And we're just getting started. Driven by core values and a shared purpose, we're fierce champions for better retirement security, known for our can-do culture where everyone plays a role in bringing our vision to life. If this sounds like a fit, we'd love you to be a part of it.
  • ● As the Newest Member of our Team, You'll:
  • ● Provide SME leadership to improve Cloud security posture, ensuring adherence to regulatory standards and best practices across all infrastructure and services.
  • ● Deploy and manage WAF, DLP (endpoints, cloud, email), XDR/ EDR platforms, Cloud Security tools (CrowdStrike CNAPP, Tenable CSPM) and SIEM and SOAR (Azure); lead Incident Response efforts while integrating AI/ML threat detection to safeguard against evolving AI based and data-centric risks.
  • ● Partner with software engineering teams to embed secure coding, conduct application security testing (SAST &DAST), and reinforce application-layer defenses throughout the SDLC.
  • ● Manage and enhance the Vulnerability Management Program using Tenable; provide SME-level threat intelligence to proactively track emerging vulnerabilities and drive the implementation of security patches, configuration changes, and targeted mitigations.
  • ● Conduct regular risk assessments, support penetration testing (external & internal), and compliance audits to enforce adherence to industry frameworks (ISO 27001, NIST, CIS, GDPR, SOC 2), while actively supporting all security audit and regulatory requirement initiatives.
  • ● Develop and continuously refine security playbooks, incident response plans, and threat-hunting methodologies to strengthen detection capabilities and organizational resilience.
  • ● Monitor, analyze, and respond to incidents via Azure Sentinel; provide SME-level support to analysts using CrowdStrike and Azure Sentinel for advanced threat investigations, while crafting SIEM use cases tailored to the current threat landscape.
  • ● Lead IR efforts-including containment, eradication, and forensic analysis-while executing a strategic vision to develop innovative approaches that accelerate threat response and remediation and continuously refine incident response plans and threat-hunting methodologies.
  • ● Harden CAAT environments against AI/ML-based attacks; provide technical mentorship to junior security engineers and analysts; and clearly communicate security risks and mitigation strategies to stakeholders.
  • ● Lead the documentation of security incidents, technical project requirements, runbooks, and standard operating procedures to institutionalize knowledge across teams as an SME.
  • ● Ensure adherence to industry standards (ISO 27001, NIST, CIS, GDPR, SOC 2) and actively support security audits and regulatory compliance initiatives.
  • ● Communicate security risks and mitigation strategies to stakeholders, collaborate cross-functionally with IT, development, and operations to embed security across the organization, and manage multiple concurrent projects while applying strong analytical and problem-solving skills, working autonomously with excellent written and verbal communication.
  • ● Integrate secure coding practices into the SDLC; conduct SAST, DAST, and IAST; perform secure code reviews; and provide tailored remediation guidance to development teams.
  • ● Manage WAF and related security solutions against OWASP Top 10 threats (SQLi, XSS, insecure deserialization); enforce API security (authentication, authorization, encryption) alongside OAuth, JWT, and MFA; and conduct threat modeling and risk assessments to identify application weaknesses.
  • ● Embed security controls into CI/CD pipelines to automate vulnerability scanning and compliance checks; utilize SCA to track and mitigate third party dependency risks; implement secrets management to eliminate hardcoded credentials; and enforce zero trust principles across DevOps workflows.
  • ● Partner with development teams as an Application Security SME to foster a security first culture, promoting proactive ownership of security controls throughout software development.