Security Analyst
The Company
At Canopy Growth, our mission is clear: improve lives, end cannabis prohibition, and strengthen communities. We believe that cannabis can be a force for good. We’re building a consumer-centric organization that is focused on sharing the transformational potential of cannabis with the world. We will achieve this through an innovative and disruptive portfolio of cannabis and hemp-derived products.
Canopy Growth is the world's leading cannabis and hemp company. We recognize that employees are at the core of our success, and we take pride in a corporate culture that emphasizes inclusiveness, collaboration, and diversity.
Our employees come from a wide range of backgrounds, each bringing their own unique skills and talents to the table, working together to continue our incredible momentum of growth. If you are interested in building global challenger brands, scaling a business, and working in a values-driven environment, we want to hear from you!
The Opportunity
Canopy Growth is seeking a highly motivated and technically proficient Security Analyst to join our Cybersecurity team. This is a unique opportunity for an individual passionate about cyber defense, threat detection, and incident response.
As a key member of our cybersecurity team, you will serve as the dedicated security operations function — monitoring threats, triaging alerts, investigating incidents, and coordinating response activities. You will work alongside our Managed Detection and Response (MDR) provider to complement external escalation with internal investigation, tuning, and cross-tool correlation. You will play a critical role in ensuring our environment remains secure as the organization continues to grow.
If you’re driven by curiosity, thrive under pressure, and want to make a direct impact on a growing cybersecurity program, this role offers the chance to contribute to Canopy Growth’s security posture at scale.
Responsibilities
Vulnerability Management
Own the end-to-end vulnerability management lifecycle using and enterprise vulnerability management platform — scanning, prioritization, tracking, and remediation coordination across servers, endpoints, network assets, and public-facing systems.
Configure and maintain scan engines, scan templates, asset groups, credentialed scanning, and scan schedules; troubleshoot authentication failures and missing assets to ensure reliable, complete coverage.
Take ownership of retesting and validating remediation to confirm findings are genuinely resolved rather than simply closed out.
Track remediation against defined SLAs, manage risk exceptions, and report on vulnerability posture and trends to technical and executive stakeholders.
Deploy and maintain scan sensors/engines across a distributed, multi-site environment.
Security Testing
Coordinate independent penetration tests, including scoping, vendor engagement, findings triage, and tracking remediation to closure.
Perform internal security testing to validate that detection and response controls (e.g., our vulnerability management, endpoint detection, and application security tooling) are performing as expected.
Apply CVSS scoring to assess and, where warranted, challenge vendor-assigned severity ratings, ensuring risk is measured consistently and accurately.
Help move the program from theoretical risk discussions toward evidence-based assurance through controlled, repeatable testing.
Application Security
Operate and administer our application security (SAST/SCA) scanning program, including onboarding repositories and managing review cadences with development teams.
Triage SAST and Software Composition Analysis (SCA) findings, distinguish true positives from noise, and work directly with developers to drive remediation of code and open-source library risks.
Partner with development and cloud teams to embed secure practices into the software development lifecycle.
Continuous Improvement & Collaboration
Research and recommend enhancements to vulnerability management, testing, and application security practices.
Support incident response readiness, including participation in tabletop exercises.
Maintain clear documentation and keep team tracking tools current as work progresses.
Stay current with cybersecurity trends, tooling, vulnerabilities, and best practices.
Other Responsibilities
Cross-train with cybersecurity team members to provide coverage during vacations, absences, and high-priority incidents.
Support team-wide initiatives, special projects, and process improvements as assigned.
Perform other duties as assigned to support the evolving needs of the cybersecurity program.
Experience
Bachelor’s degree in Computer Science, Information Security, Engineering, or a related field (or equivalent practical experience).
3+ years of hands-on experience in vulnerability management, security testing, or offensive security roles.
Hands-on experience with an enterprise vulnerability management platform, including scan engine configuration and credentialed scanning.
Working knowledge of application security testing concepts and tools (SAST/SCA) and the ability to communicate findings effectively with developers.
Solid understanding of the Common Vulnerability Scoring System (CVSS) and vulnerability assessment methodologies.
Familiarity with penetration testing concepts and experience coordinating or supporting third-party testing engagements.
Strong working knowledge of Linux and Windows operating systems, network protocols, and common security tools.
Familiarity with cybersecurity frameworks such as NIST 800-53, NIST CSF, or ISO 27001.
Preferred certifications include OSCP, GIAC GPEN/GWAPT, CEH, CompTIA PenTest+, CySA+.
Strong problem-solving, documentation, and communication skills, with the ability to engage both technical and non-technical audiences.
Proven ability to manage multiple security priorities in a fast-paced, evolving environment.
Previous experience in an IT Operations/Infrastructure role would be an asset
Other Details
This is a full-time, remote-first position based out of Ontario.
Salary Range: $80,000 - $90,000
Benefits – extended health and dental coverage, paid vacation, and participation in our employer-supported retirement savings program
We appreciate your interest, and promise to review all applications, but we will only be contacting those who best fit the requirements.
We welcome and encourage applications from people with disabilities. Accommodations are available upon request for candidates taking part in all aspects of the selection process. If you require accommodation, please notify your Talent Acquisition Partner. Please note, the chosen applicant will be required to successfully complete background and reference checks.
Recruitment Process: All applications for this role are reviewed manually; no AI-based screening or ranking tools are used.
This post is for an existing vacancy.