Job Summary
The Internal Security Analyst safeguards the organization’s information systems, networks, applications, and data by identifying, assessing, and reducing cybersecurity risk. The role develops and maintains security policies and controls, monitors the security environment, coordinates incident response, and supports a consistent, risk-based approach to cybersecurity across the organization.
Key Responsibilities
- Develop, maintain, and regularly review information security policies, standards, procedures, and guidelines.
- Assess the organization’s security posture through vulnerability assessments, configuration reviews, risk assessments, and coordinated penetration testing.
- Identify, prioritize, track, and remediate security vulnerabilities across infrastructure, applications, cloud services, and endpoints.
- Coordinate internal and external security testing engagements and oversee the timely resolution of identified findings.
- Monitor security alerts, logs, and threat intelligence sources to identify suspicious activity.
- Review and improve security configurations across servers, workstations, networks, and cloud platforms.
- Coordinate cybersecurity incident response, including investigation, containment, recovery, escalation, documentation, and post-incident review.
- Develop, maintain, and test incident response plans, playbooks, escalation procedures, and communication protocols.
- Administer or oversee identity and access management controls, privileged access, and periodic user access reviews.
- Conduct cybersecurity assessments of third-party vendors and service providers and monitor the timely remediation of identified risks.
- Provide security guidance and requirements for new systems, applications, integrations, infrastructure changes, and technology projects.
- Develop and deliver cybersecurity awareness training, phishing simulations, and related employee education initiatives.
- Maintain security metrics, risk registers, and remediation records, and report to leadership on key risks, vulnerabilities, incidents, compliance, and improvement priorities.
- Support business continuity, disaster recovery, backup-security testing, and related exercises to strengthen organizational resilience.
- Remain current on emerging threats, vulnerabilities, regulatory requirements, industry standards, and security technologies, and recommend appropriate improvements.
- Collaborate with Information Technology, Legal, Human Resources, Privacy, operational teams, and external service providers on security initiatives, risk treatment, and incident response.
Knowledge and Skills
- Working knowledge of recognized cybersecurity frameworks and standards, such as the NIST Cybersecurity Framework, CIS Controls, ISO/IEC 27001, or comparable standards.
- Knowledge of Microsoft 365 security, endpoint protection, security information and event management, log management, firewalls, vulnerability management tools, identity and access management, and cloud security principles.
- Strong analytical, investigative, documentation, and problem-solving skills, with the ability to assess risk and recommend practical, proportionate controls.
- Ability to communicate technical risks, findings, and recommendations clearly to both technical and non-technical stakeholders.
- Strong judgment, discretion, attention to detail, and the ability to handle confidential and sensitive information appropriately.
Education
- Diploma or Bachelor's Degree in Cybersecurity, Information Technology, Computer Science, Information Systems, or a related field.
- Equivalent combination of training and experience may be considered.
Experience
- Minimum 3 years of experience in a cybersecurity, information security, security analyst, or related role.
- Experience with security monitoring, vulnerability management, incident response, risk assessment, and policy development.
- Experience working within enterprise Windows, network, cloud, and Microsoft 365 environments is considered an asset.
Certifications
A recognized cybersecurity certification is required. Relevant certifications may include CompTIA Security+, GIAC Security Essentials (GSEC), Systems Security Certified Practitioner (SSCP), Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Ethical Hacker (CEH), or a Microsoft security certification. Additional relevant certifications are considered an asset.
Working Conditions
- Work is primarily performed in an office and computer-based environment, with extended periods of screen use.
- Occasional work outside regular business hours may be required to respond to security incidents or support testing, upgrades, maintenance, and recovery activities.
- The position requires the ability to manage competing priorities and respond effectively in time-sensitive situations.
What We Offer
- Opportunities for professional growth and development
- Permanent, year-round positions
- Employee Assistance Program (EAP)
- Group home and auto insurance
- Active social committee
- Subsidized lunches at our on-site cafeteria
- Work at a state-of-the-art manufacturing facility in Markdale, Ontario
- The chance to join an international, award-winning business - the largest ice cream manufacturer in Canada
- A positive workplace culture where we take pride in what we do and strive for excellence
- Free ice cream!
Compensation
At Chapman’s, compensation is guided by a pay-for-performance philosophy that recognizes and rewards individual contributions.
Salary
$85,000 to $115,000 salary range.
In addition to wages, employees will be eligible for:
- Regular wage reviews as part of a comprehensive total rewards package
- Retirement savings program, including a company-matching pension plan to support long-term financial planning
- Comprehensive extended health, dental, life, and disability benefits
- Mental health support as part of the benefits program
Disclaimer
The above statements are intended to describe the general nature and level of work to be performed. They are not to be construed as an exhaustive list of all responsibilities, duties, and skills required. All personnel may be required to perform duties outside of their normal responsibilities from time to time and as needed.
We thank all those that apply in advance for your application, however only those selected will be contacted, no phone inquiries please.
