Security Analyst

Canopy Growth Corporation•Toronto, ON

4d•CA$80,000 - CA$90,000•Remote

About The Position

Canopy Growth is seeking a highly motivated and technically proficient Security Analyst to join our Cybersecurity team. This is a unique opportunity for an individual passionate about cyber defense, threat detection, and incident response. As a key member of our cybersecurity team, you will serve as the dedicated security operations function — monitoring threats, triaging alerts, investigating incidents, and coordinating response activities. You will work alongside our Managed Detection and Response (MDR) provider to complement external escalation with internal investigation, tuning, and cross-tool correlation. You will play a critical role in ensuring our environment remains secure as the organization continues to grow. If you’re driven by curiosity, thrive under pressure, and want to make a direct impact on a growing cybersecurity program, this role offers the chance to contribute to Canopy Growth’s security posture at scale.

Requirements

Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field (or equivalent practical experience).
3+ years of hands-on experience in vulnerability management, security testing, or offensive security roles.
Hands-on experience with an enterprise vulnerability management platform, including scan engine configuration and credentialed scanning.
Working knowledge of application security testing concepts and tools (SAST/SCA) and the ability to communicate findings effectively with developers.
Solid understanding of the Common Vulnerability Scoring System (CVSS) and vulnerability assessment methodologies.
Familiarity with penetration testing concepts and experience coordinating or supporting third-party testing engagements.
Strong working knowledge of Linux and Windows operating systems, network protocols, and common security tools.
Familiarity with cybersecurity frameworks such as NIST 800-53, NIST CSF, or ISO 27001.
Preferred certifications include OSCP, GIAC GPEN/GWAPT, CEH, CompTIA PenTest+, CySA+.
Strong problem-solving, documentation, and communication skills, with the ability to engage both technical and non-technical audiences.
Proven ability to manage multiple security priorities in a fast-paced, evolving environment.
Previous experience in an IT Operations/Infrastructure role would be an asset

Responsibilities

Own the end-to-end vulnerability management lifecycle using and enterprise vulnerability management platform — scanning, prioritization, tracking, and remediation coordination across servers, endpoints, network assets, and public-facing systems.
Configure and maintain scan engines, scan templates, asset groups, credentialed scanning, and scan schedules; troubleshoot authentication failures and missing assets to ensure reliable, complete coverage.
Take ownership of retesting and validating remediation to confirm findings are genuinely resolved rather than simply closed out.
Track remediation against defined SLAs, manage risk exceptions, and report on vulnerability posture and trends to technical and executive stakeholders.
Deploy and maintain scan sensors/engines across a distributed, multi-site environment.
Coordinate independent penetration tests, including scoping, vendor engagement, findings triage, and tracking remediation to closure.
Perform internal security testing to validate that detection and response controls (e.g., our vulnerability management, endpoint detection, and application security tooling) are performing as expected.
Apply CVSS scoring to assess and, where warranted, challenge vendor-assigned severity ratings, ensuring risk is measured consistently and accurately.
Help move the program from theoretical risk discussions toward evidence-based assurance through controlled, repeatable testing.
Operate and administer our application security (SAST/SCA) scanning program, including onboarding repositories and managing review cadences with development teams.
Triage SAST and Software Composition Analysis (SCA) findings, distinguish true positives from noise, and work directly with developers to drive remediation of code and open-source library risks.
Partner with development and cloud teams to embed secure practices into the software development lifecycle.
Research and recommend enhancements to vulnerability management, testing, and application security practices.
Support incident response readiness, including participation in tabletop exercises.
Maintain clear documentation and keep team tracking tools current as work progresses.
Stay current with cybersecurity trends, tooling, vulnerabilities, and best practices.
Cross-train with cybersecurity team members to provide coverage during vacations, absences, and high-priority incidents.
Support team-wide initiatives, special projects, and process improvements as assigned.
Perform other duties as assigned to support the evolving needs of the cybersecurity program.