Medavie is a not-for-profit health solutions organization that has been operating since 1943. The scope is massive: Medavie Blue Cross serves nearly one in ten Canadians with health, dental, travel, life, and disability benefits. Medavie Health Services runs the country's largest contracted emergency medical services network. The attack surface is the entire Canadian healthcare pipeline - insurance data, EMS dispatch, primary care delivery, and clinical training systems across eight provinces.
The threat model here is broad and high-stakes. You are protecting the personal health information of millions of Canadians, operational data for emergency medical services, and the financial systems underpinning insurance benefits. The organization reinvests profits into innovative technologies, which signals active modernization of the stack rather than legacy maintenance. The 8,500-person workforce scales the operational complexity significantly.
For a security team, this is not a single-domain problem. The work spans securing insurance platforms, protecting EMS operational technology and dispatch integrity, safeguarding primary care patient data, and supporting the Medavie Foundation's community health initiatives. The not-for-profit structure means the mission is explicit - improving wellbeing - so security is directly tied to public trust and service continuity, not just compliance checkboxes.
