IT Advisor - Cloud and Application Security Advisor Save

About Us

A workplace powered by you. At BC Hydro, we’re working towards creating a cleaner and more sustainable future for all British Columbians and need people like you to help us. A career at BC Hydro is meaningful and provides you the opportunity to be part of a talented, inclusive, and diverse team. We offer a healthy work-life balance, competitive wages, a comprehensive benefits package, and training opportunities to support you in your career growth. We're proud to be ranked as one of B.C.'s Top Employers and one of Canada's Best Diversity Employers.

We invite you to join us as we build an even cleaner B.C. We welcome applications from all qualified job seekers. If you’re a person with a disability, please let us know by emailing [email protected], as adjustments can be made to help support you in your application process.

About the Job

IT Advisor - Cloud and Application Security Advisor

Number of positions: 1

Job Location: Dunsmuir 08

Employment type: Permanent

Region: Lower Mainland

Hours of work: Full-time (37.5 hrs/wk) Flexible Work

Role: Hybrid

Annual salary: $109,700.00 - 138,700.00

What You’ll Do

• Work with stakeholders to establish a set of security practices that cover all aspects of application development, from design to deployment, to create a robust application security program.
• Formulate and advocate for security policies and standards related to applications, databases, and cloud infrastructure.
• Contribute to business cases, tool evaluations, and application security guidelines that support the cybersecurity roadmap.
• Work with stakeholders to establish automated security verification and testing practices for applications.
• Perform hands-on secure code reviews and application security testing, including SAST, DAST, and SCA, to identify vulnerabilities before applications are migrated or released to production.
• Administer and optimize application security tooling within GitHub Enterprise, including GitHub Advanced Security (GHAS), CodeQL, and GitHub Actions policies.
• Identify and mitigate software supply chain risks related to third-party actions, open-source packages, and developer tools and extensions.
• Identify application security requirements by using threat modeling and an understanding of the compliance and regulatory landscape.
• Work with stakeholders to apply application security principles across cloud-native application development to support secure cloud deployments.
• Review Infrastructure as Code (IaC) templates and deployment pipelines to ensure secure configurations, approval gates, and proper separation of production and non-production environments.
• Support architecture in the establishment of application and cloud security posture management and workload protection solutions.
• Collaborate with Cybersecurity Operations and Infrastructure teams to validate detection and response capabilities for cloud applications, including web application firewall (WAF) policies and purple team exercises.
• Support application security champion initiatives to reinforce security principles to improve security culture.
• Provide technical guidance and mentorship to team members and contract resources.

What You Bring

• University or College degree in Computer Science, Information Technology or related field, or a combination of education and experience may be considered.
• A minimum of 7 years of dedicated experience in application and cloud security.
• Experience replacing legacy, on-premises applications with cloud-based applications, with a focus on secure migration pathways, on-demand computing, and scalability.
• A background in software development with a strong grasp of cloud platforms like AWS, Azure, or Google Cloud.
• Experience reviewing code in languages and frameworks such as C#/.NET and JavaScript/Node.js.
• Hands-on experience with GitHub Enterprise and GitHub Advanced Security, including CodeQL and secure GitHub Actions workflows.
• Hands-on experience with static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and manual penetration testing using tools such as Burp Suite or ZAP.
• Proven ability to work with external system integrators, vendors, and managed service providers to deliver secure outcomes.
• An analytical mindset with meticulous problem-solving skills.
• Outstanding communication abilities, both in writing and speaking.
• Preferred certifications include GIAC Cloud Security Automation (GCSA), GIAC Cloud Security Essentials Certification (GCLD), GIAC Public Cloud Security (GPCS), Microsoft Certified: DevOps Engineer Expert (AZ-400), Microsoft Certified: Azure Security Engineer Associate (AZ-500), GitHub Advanced Security (GH-500).

What We Offer

• A comprehensive benefits package
• A minimum of 15 paid vacation days
• A lifetime pension
• Flexible work model, depending on your role type
• Training and development courses

For more information on the benefits we offer, visit bchydro.com/benefits.

What Else You Should Know

Don't forget to update your Candidate Profile with your current resume and copies of your certifications. If applicable, include your Trades Qualification. This will ensure we have all the necessary information to assess your application without any delays.