Senior Cyber Security Specialist

Embark on a rewarding career with Sobeys Inc., celebrated among Canada’s Top 100 employers where your unique contributions drive success.

We are seeking a highly skilled and forward-thinking Senior Cybersecurity Specialist to help advance and modernize our Offensive Security and Application Security capabilities. This role will play a critical part in shaping the future of security testing across traditional applications, cloud platforms, APIs, and emerging AI-powered systems.

As a senior member of the team, you will partner closely with security leadership to design and evolve offensive security frameworks, testing methodologies, policies, standards, and governance practices that keep pace with rapidly changing technologies and threat landscapes. You will contribute to complex penetration testing engagements, perform advanced application security assessments, contribute to red team operations, and help establish best practices for securing AI-enabled products and services.

Sobeys is full of exciting opportunities, and we are always looking for bright new talent to join our team! We currently have a full-time opportunity for a Senior Cyber Security Specialist. This role can be based out of one our main offices including:
Mississauga, ON. Calgary, AB;
Burnaby, BC;
Stellarton, NS.

The successful candidate combines deep technical expertise with strategic thinking, enabling them to influence security programs, mentor team members, and drive innovation in offensive security, application security, and AI security testing.

• Lead the planning, coordination, and oversight of penetration testing engagements across enterprise systems, external-facing applications, cloud environments, APIs, and critical business platforms.
• Act as the primary technical liaison with external security testing providers, ensuring testing activities align with organizational objectives, methodologies, and risk priorities.
• Review, validate, and challenge security findings to ensure accuracy, context, and business relevance.
• Perform targeted hands‑on security assessments and technical validation activities where required to support high-risk initiatives or complex findings.
• Coordinate and support red team exercises and adversarial assessments while ensuring alignment with organizational threat scenarios and business risks.

• Perform comprehensive Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), Software Composition Analysis (SCA), and manual application security reviews.
• Conduct secure code reviews to identify vulnerabilities, insecure design patterns, authentication weaknesses, and other application-layer risks.
• Evaluate web, mobile, API, SaaS, and internally developed applications against industry standards including OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, and Mobile Security Testing Guide
• Support secure‑by‑design initiatives and provide security guidance throughout the Software Development Lifecycle (SDLC).

• Partner with leadership to establish and mature offensive security and application security frameworks, standards, policies, and assessment methodologies.
• Continuously evaluate industry trends, threat intelligence, and security innovations to identify opportunities for program enhancement.
• Develop security testing playbooks, reporting standards, risk‑rating methodologies, and operational procedures.
• Provide technical leadership and mentorship to team members while fostering a culture of continuous learning and innovation.
• Advocate for security best practices and influence strategic security decisions across the organization.

• Translate technical findings into business‑focused risk assessments and actionable remediation guidance.
• Collaborate with Infrastructure, Engineering, Cloud, Architecture, and Dev Sec Ops  teams to improve security posture and reduce organizational risk.
• Support regulatory, compliance, and audit requirements through effective security documentation and reporting.

• Develop…