Cyber Security Engineer

Cyber Security Engineer About GroupHEALTH At GroupHEALTH, we're proud of the work we do – but it's how we do it that truly sets us apart. We're a fast-moving, ever-evolving, stable organization with deep roots and a bold vision: to transform the way Canadians experience benefits. We combine agility with long-term stability to create meaningful impact. Here, you'll find more than just a job. You'll find a purpose-driven, people-first culture where kindness, collaboration, and curiosity thrive. Whether you've been here fifteen years or fifteen days, you'll notice right away – our people are genuinely invested in one another's success and delivering exceptional experiences to our clients and plan members. About the Role The Cyber Security Engineer will implement, operate, and continuously improve technical security controls across the organization. The role protects identities, endpoints, cloud environments, networks, applications, and data by identifying and remediating security risks, improving detection capabilities, and providing hands-on technical support during security incidents. This is a hybrid role based out of our Surrey, BC office, working 3 days in office and 2 days from home. What to Expect in Your First 3 Months First 30 Days: Complete onboarding and assess the organization's technology and security environment, identifying priority vulnerabilities, misconfigurations, monitoring gaps, and remediation opportunities. First 60 Days: Begin remediation of prioritized security gaps across identity, endpoint, cloud, network, and infrastructure environments. Establish or improve vulnerability management processes to ensure critical and high-risk vulnerabilities are identified, prioritized, tracked, remediated, and validated. First 90 Days: Demonstrate measurable improvement in technical security posture through remediation of priority vulnerabilities, misconfigurations, and security control gaps. Improve security monitoring and detection capabilities through alert tuning, enhanced detections, and technical incident response playbooks. Establish a prioritized security engineering backlog aligned with the Cyber Security roadmap and provide measurable technical security metrics for ongoing reporting. What You'll Do Implement and maintain technical security controls across endpoints, identities, cloud platforms, networks, applications, and infrastructure Administer, configure, monitor, and optimize security platforms and tools Monitor and investigate security alerts, suspicious activities, and potential security incidents Perform technical investigation, containment, remediation, and root-cause analysis during security incidents Support the Cyber Security Manager during P1 and P2 security incidents Operate and continuously improve the vulnerability management program Identify security vulnerabilities, misconfigurations, and control gaps and coordinate remediation with technology teams Implement and maintain identity security controls including MFA, Conditional Access, privileged access, and least privilege Support endpoint, email, cloud, and Microsoft 365 security controls Develop and improve security detections, alerts, dashboards, queries, and incident response playbooks Support SIEM, EDR/XDR, vulnerability management, and security monitoring capabilities Develop scripts and automation to improve security operations and reduce manual effort Support penetration testing engagements and track technical findings through remediation Provide technical evidence for audits, risk assessments, regulatory requirements, cyber insurance, and third-party reviews Participate in security architecture and technical design reviews for new systems and significant technology changes Maintain accurate technical security documentation, procedures, configurations, and diagrams Stay current on emerging threats, vulnerabilities, attack techniques, and security technologies What We're Looking For Bachelor's degree in Cyber Security, Information Security, Computer Science, Information Technology, or a related field; equivalent experience considered 3-5 years of hands-on experience in cyber security, security engineering, security operations, infrastructure security, or a related technical security role Demonstrated experience implementing and operating enterprise security controls Hands-on experience investigating security alerts and incidents Experience with vulnerability management, security hardening, and remediation Experience securing Microsoft enterprise environments, including Microsoft 365, Azure, and Entra ID Experience with SIEM, EDR/XDR, identity security, endpoint security, and vulnerability management technologies Experience with PowerShell, KQL, Python, APIs, or other security automation technologies is an asset Experience in insurance, healthcare, financial services, or another regulated environment is an asset Knowledge of NIST CSF, CIS Controls, and ISO 27001 is preferred Relevant security certifications such as Microsoft AZ-500, SC-200, CompTIA Security+, GIAC, or equivalent are preferred; additional cybersecurity certifications are considered an asset Critical Competencies You will succeed in this role if you are: A Technical Problem Solver with Incident Ownership – Investigates security issues methodically, identifies root cause, and implements practical solutions. Remains calm and methodical during incidents, taking ownership of technical investigation and containment through to resolution. A Risk-Based, Business-Pragmatic Decision Maker – Prioritizes security activities based on risk, exploitability, and business impact rather than treating all findings equally. Balances security requirements with operational needs to implement controls that meaningfully reduce risk. An Automation-Minded Security Professional – Proactively identifies opportunities to use scripting, APIs, queries, and security tools to improve efficiency and security outcomes. An Organized and Accountable Executor – Plans and prioritizes work effectively, maintains accurate documentation, and drives assigned remediation activities through to completion. A Strong Communicator and Collaborator – Clearly communicates technical security issues and recommendations to technical and non-technical stakeholders, building productive relationships across teams to achieve security outcomes. A Continuous Learner – Maintains current knowledge of emerging threats, vulnerabilities, and security technologies, applying that knowledge to continuously improve the organization's security posture. Compensation At the time of this posting, the estimated annual base salary for this position is $90,000-$100,000. Individual compensation within this range is determined by factors such as job-related skills, relevant experience, and education/training. This range reflects the annual base salary only and does not encompass the comprehensive total rewards package that we proudly offer. Why Join Us Beyond salary, we offer generous paid time off, extended health and dental benefits, RRSP matching, and flexible work options Wellness support, including comprehensive mental health resources, to prioritize your well-being both in and out of the workplace A supportive culture, with opportunities to grow, and where our team members feel valued and empowered to thrive. Accommodation and Inclusion GroupHEALTH is committed to equity, diversity, and inclusion. If you need accommodation during any stage of the hiring process, please let us know! We're here to help. If you're ready to do meaningful work and grow your career with GroupHEALTH, we'd love to hear from you. Click Apply to submit your application.